Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
## Vulnerability Summary
**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
**Affected Component:** `filelock` package - `SoftFileLock` class
**File:** `src/filelock/_soft.py` lines 17-27
**CWE:** CWE-362, CWE-367, CWE-59
---
## Description
A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.
The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.
### Attack Scenario
```
1. Lock attempts to acquire on /tmp/app.lock
2. Permission validation passes
3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock
4. os.open() tries to create lock file
5. Lock operates on attacker-controlled target file or fails
```
---
## Impact
_What kind of vulnerability is it? Who is impacted?_
This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.
**Affected Users:**
- Applications using `filelock.SoftFileLock` directly
- Applications using the fallback `FileLock` on systems without `fcntl` support (e.g., GraalPy)
**Consequences:**
- **Silent lock acquisition failure** - applications may not detect that exclusive resource access is not guaranteed
- **Denial of Service** - attacker can prevent lock file creation by maintaining symlink
- **Resource serialization failures** - multiple processes may acquire "locks" simultaneously
- **Unintended file operations** - lock could operate on attacker-controlled files
**CVSS v4.0 Score:** 5.6 (Medium)
**Vector:** CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
**Attack Requirements:**
- Local filesystem access to the directory containing lock files
- Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)
- Ability to time the symlink creation during the narrow race window
---
## Patches
_Has the problem been patched? What versions should users upgrade to?_
Yes, the vulnerability has been patched by adding the `O_NOFOLLOW` flag to prevent symlink following during lock file creation.
**Patched Version:** Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)
**Mitigation Details:**
- The `O_NOFOLLOW` flag is added conditionally and gracefully degrades on platforms without support
- On platforms with `O_NOFOLLOW` support (most modern systems): symlink attacks are completely prevented
- On platforms without `O_NOFOLLOW` (e.g., GraalPy): TOCTOU window remains but is documented
**Users should:**
- Upgrade to the patched version when available
- For critical deployments, consider using `UnixFileLock` or `WindowsFileLock` instead of the fallback `SoftFileLock`
---
## Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
For users unable to update immediately:
1. **Avoid `SoftFileLock` in security-sensitive contexts** - use `UnixFileLock` or `WindowsFileLock` when available (these were already patched for CVE-2025-68146)
2. **Restrict filesystem permissions** - prevent untrusted users from creating symlinks in lock file directories:
```bash
chmod 700 /path/to/lock/directory
```
3. **Use process isolation** - isolate untrusted code from lock file paths to prevent symlink creation
4. **Monitor lock operations** - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations
---
## References
_Are there any links users can visit to find out more?_
- **Similar Vulnerability:** CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)
- **CWE-362 (Concurrent Execution using Shared Resource):** https://cwe.mitre.org/data/definitions/362.html
- **CWE-367 (Time-of-check Time-of-use Race Condition):** https://cwe.mitre.org/data/definitions/367.html
- **CWE-59 (Improper Link Resolution Before File Access):** https://cwe.mitre.org/data/definitions/59.html
- **O_NOFOLLOW documentation:** https://man7.org/linux/man-pages/man2/open.2.html
- **GitHub Repository:** https://github.com/tox-dev/filelock
---
**Reported by:** George Tsigourakos (@tsigouris007)
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Qfinder Pro Mac 7.13.0 and later
Qsync for Mac 5.1.5 and later
QVPN Device Client for Mac 2.2.8 and later
CVE-2025-12838 is a high-severity local privilege escalation vulnerability in MSP360 Free Backup version 8.1.0.620. It arises from improper link resolution before file access in the restore functionality, allowing attackers with low-privileged code execution to escalate privileges to SYSTEM by abusing junction points. Exploitation requires local code execution and administrative user interaction, making it a targeted but potent threat. The vulnerability can lead to full system compromise, affecting confidentiality, integrity, and availability. No known exploits are currently in the wild, but the risk remains significant due to the potential impact. European organizations using MSP360 Free Backup should prioritize patching and implement strict local access controls. Countries with higher MSP360 adoption and critical infrastructure reliance on backup solutions are at greater risk.
Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations using the quarantine module. Attackers can leverage symbolic link techniques to restore quarantined files to restricted directories, potentially enabling system-level access through techniques like DLL hijacking.
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.
filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
CVE-2025-46636 is a medium severity vulnerability in Dell Encryption versions prior to 11.12.1 involving improper link resolution before file access (CWE-59). A low privileged local attacker can exploit this flaw by tricking the software into following symbolic links, potentially leading to information tampering. The vulnerability requires local access and some user interaction, with no impact on confidentiality but high impact on integrity and availability. No known exploits are currently reported in the wild. European organizations using Dell Encryption should prioritize patching once updates are available and implement strict local access controls. Countries with high Dell enterprise software adoption and critical infrastructure using encryption solutions are at greater risk. The vulnerability’s CVSS score is 6.6, reflecting moderate risk due to the attack complexity and limited scope.
Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local malicious user could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2025-34352 is a high-severity local privilege escalation vulnerability in JumpCloud Remote Assist for Windows versions prior to 0.317.0. It arises from insecure creation and manipulation of temporary files by the uninstaller running with SYSTEM privileges. A low-privileged local attacker can exploit this by creating a user-writable %TEMP% subdirectory with weak permissions and leveraging symbolic links or mount points to redirect file operations. This can lead to arbitrary file writes or deletions in protected system locations, potentially causing denial of service or escalation to SYSTEM privileges. No user interaction is required, but local access with low privileges is necessary. The vulnerability affects Windows systems with JumpCloud Remote Assist installed and managed via the JumpCloud Agent lifecycle. The issue is fixed in version 0.317.
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program.
Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of Service as a result. The issue is resolved through the hotfixes InstallShield2025R1-CVE-2025-12418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatch.