CVE-2025-68146

CVE-2025-68146 is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the Python filelock library (versions prior to 3.20.1), allowing local attackers to corrupt or truncate arbitrary user files via symlink attacks on Unix and Windows systems. This vulnerability, rated Medium severity (CVSS 6.5), requires local filesystem access and the ability to create symlinks, with successful exploitation often occurring within 1-3 attempts. While there is no evidence of active exploitation, public exploit code, or significant community discussion, upgrading to version 3.20.1 is strongly recommended as workarounds offer only partial mitigation.