Time-of-Check-Time-of-Use (TOCTOU) Race Condition

🗓️ 25 Feb 2026 09:40:41Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 1 Views

TOCTOU race in filelock from improper checks before truncating files, enabling symlink truncation.

Reporter	Title	Published	Views	Family All 81
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses filelock which is vulnerable to CVE-2025-68146	20 Mar 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: TOCTOU Symlink Vulnerability in filelock, affects watsonx.data	7 Apr 202610:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses filelock-3.12.2-py3-none-any.whl which is vulnerable to CVE-2025-68146.	30 Mar 202606:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in filelock-3.12.2-py3-none-any.whl	16 Apr 202617:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes April 2026	27 May 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation for Cloud Pak	23 Mar 202614:06	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	26 Feb 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation	23 Mar 202613:59	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses filelock-3.20.1-py3-none-any.whl, filelock-3.20.2-py3-none-any.whl which is vulnerable to CVE-2026-22701.	27 Feb 202612:41	–	ibm

Vulners

Node

tox-dev filelockRange3.2.0–3.20.0python

tox-dev filelockRange0.2.0–3.20.0python

Source	Link
github	www.github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
pubs	www.pubs.opengroup.org/onlinepubs/9699919799/functions/open.html
learn	www.learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
github	www.github.com/tox-dev/filelock/releases/tag/3.20.1
github	www.github.com/advisories/GHSA-w853-jp5j-5j7f
github	www.github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f
github	www.github.com/tox-dev/filelock/pull/461

03 Jun 2026 09:54Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.3 - 6.5

EPSS0.00004

SSVC