CVE-2026-22701

CVE-2026-22701 is a Time-of-Check-to-Time-of-Use (TOCTOU) race condition vulnerability in the SoftFileLock implementation of the Python filelock package, affecting versions prior to 3.20.3. A local attacker with filesystem access and symlink creation privileges can exploit a race condition during lock file creation, potentially causing lock operations to fail or target unintended files. This vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity but high impact on availability and low impact on integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant media coverage, though it has garnered some community discussion.