filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

🗓️ 13 Jan 2026 18:44:55Reported by GitHub Advisory DatabaseType

TOCTOU race in SoftFileLock enables symlink attack after permission check, causing silent lock failures.

Reporter	Title	Published	Views	Family All 75
IBM Security Bulletins	Security Bulletin: Vulnerability in filelock affects IBM Netezza Appliance	15 Apr 202611:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in filelock-3.12.2-py3-none-any.whl	13 Apr 202615:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Link Resolution Before File Access in filelock [CVE-2026-22701]	14 Apr 202614:57	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses werkzeug-3.1.4-py3-none-any.whl, filelock-3.20.1-py3-none-any.whl which is vulnerable to CVE-2026-21860 and CVE-2026-22701.	31 Mar 202612:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	16 Apr 202612:23	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses filelock which is vulnerable to CVE-2026-22701	5 May 202608:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses filelock-3.20.1-py3-none-any.whl, filelock-3.20.2-py3-none-any.whl which is vulnerable to CVE-2026-22701.	27 Feb 202612:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	7 May 202613:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses filelock which is vulnerable to CVE-2026-22701	5 May 202608:39	–	ibm

Vulners

Node

tox-dev filelockRange<3.20.3pip

Source	Link
github	www.github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22701
github	www.github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0
github	www.github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
github	www.github.com/advisories/GHSA-qmgc-5h2g-mvrw

13 Jan 2026 18:44Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3

EPSS0.00006

SSVC

symlink attack lock file race permission race window