Detections
Analytics

SCA: security update for filelock (GHSA-w853-jp5j-5j7f)

medium Tenable Self-Hosted Container Security Plugin ID 436416

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-
 Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files
 through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where
 filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing
 to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and
 truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted.
 The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability
 to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation
 succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1.
 If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note:
 different locking semantics, may not be suitable for all use cases); ensure lock file directories have
 restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor
 lock file directories for suspicious symlinks before running trusted applications. These workarounds
 provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is
 strongly recommended. (CVE-2025-68146)

See Also

https://github.com/advisories/GHSA-w853-jp5j-5j7f

Plugin Details

Severity: Medium

ID: 436416

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 12/17/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.7

Temporal Score: 4.5

Vector: CVSS2#AV:L/AC:H/Au:S/C:P/I:C/A:C

CVSS Score Source: CVE-2025-68146

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/16/2025

Vulnerability Publication Date: 12/16/2025

Reference Information

CVE: CVE-2025-68146