Improper Link Resolution Before File Access ('Link Following')

Summary

filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the "SoftFileLock" implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the "_acquire()" method between "raise_on_not_writable_file()" (permission check) and "os.open()" (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to Denial-of-Service(DOS).