GHSA-qmgc-5h2g-mvrw · 深刻度： medium · エコシステム： pip — filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.
総合評価: CVE-2026-22701 は低リスク（21.9/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.11%、2 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.01% | 0.11% | +0.10% |
| 2 | 2026-01-10 | — | 0.01% | — |
EPSS の全履歴 （全 2 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
1.0 | 4.2 | [email protected] |
GHSA-qmgc-5h2g-mvrw · 深刻度： medium · エコシステム： pip — filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2026-22701: 1 source package rows (py3-filelock); 6 state rows across 3 repos (3.23-main, edge-community, edge-main); fixed 0, open 6. | https://security.alpinelinux.org/vuln/CVE-2026-22701 |
debian
|
not yet assigned | CVE-2026-22701 not yet assigned priority: Debian including 1 source packages (python-filelock), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2026-22701 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-22701 |
suse
|
medium | CVE-2026-22701 severity moderate: SUSE including 21 source package names (2.1.3-5.8:e2fsprogs-1.47.0-3.1, 2.1.3-5.8:libcom_err2-1.47.0-3.1, …), 72 product×package rows across 43 product lines (Container suse/multi-linux-manager/5.1/x86_64/server, Container suse/sl-micro/6.0/baremetal-os-container, … (43 product lines)): Fixed 71, First Fixed 1. | https://www.suse.com/security/cve/CVE-2026-22701/ |
ubuntu
|
medium | CVE-2026-22701 medium priority: Ubuntu including 1 source packages (python-filelock), 7 status rows across 7 suites (bionic, focal, jammy, noble, plucky, questing, upstream): released 4, ignored 1, needed 1, needs-triage 1. | https://ubuntu.com/security/CVE-2026-22701 |