Security readout for executives and security teams
Plain-English summary
CVE-2026-22701 affects the Python filelock package before 3.20.3. A local user who can create symlinks near a lock file may race the lock creation process, causing locking to fail or target an unexpected file. Business impact is mainly denial of service or unreliable application behavior, not remote compromise.
Executive priority
Treat as a moderate-priority dependency update. Prioritize shared systems, multi-user hosts, build infrastructure, and services using writable temporary directories for lock files. It is less urgent than remotely exploitable vulnerabilities but should be remediated through normal patch cycles.
Technical view
The issue is a TOCTOU race in SoftFileLock._acquire() between raise_on_not_writable_file() and os.open(). With local filesystem access and symlink creation rights, an attacker may influence the lock path during the race window. The CVE lists CWE-362, CWE-367, and CWE-59. Fixed in filelock 3.20.3.
Likely exposure
Exposure is limited to systems using tox-dev filelock versions before 3.20.3, specifically SoftFileLock, where untrusted local users can interact with the lock file location. Network-only attackers are not indicated by the provided sources.
Exploitation context
The CVSS vector is local, high complexity, low privileges, no user interaction. The source bundle does not indicate known active exploitation, and KEV is false. Practical risk depends on whether attackers can write or create symlinks in directories used for lock files.
Researcher notes
The advisory describes a race between permission validation and file creation in SoftFileLock. The stated outcomes are unexpected lock behavior, unintended target file interaction, or denial of service. Public sources provided do not claim confidentiality impact, remote exploitation, or active exploitation.
Mitigation direction
- Upgrade filelock to version 3.20.3 or later.
- Identify transitive dependencies that bundle or pin filelock below 3.20.3.
- Restrict untrusted local write access to directories used for lock files.
- Review vendor advisory and commits for implementation-specific guidance.
Validation and detection
- Inventory Python environments for installed filelock versions below 3.20.3.
- Confirm whether applications use SoftFileLock rather than other locking modes.
- Review lock file paths for shared or untrusted writable directories.
- Verify updated deployments resolve filelock to 3.20.3 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22701 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H14.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrwCVE reference · x_refsource_CONFIRM
- https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0CVE reference · x_refsource_MISC
- https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.