filelock is a platform-independent file lock for Python. Before version 4.2.1, the UnixFileLock implementation can truncate any regular file if a different local user with rename or hard‑link permission re‑names or hard‑links that file onto the lock path. When an explicit mode is requested, older releases also change the file’s permissions. This flaw allows a local attacker to destroy data and alter file permissions, potentially affecting confidentiality and integrity of the overwritten file. The weakness occurs due to improper handling of the lock path, identified as CWE-706.

The vulnerability affects the tox‑dev filelock library in all releases prior to 4.2.1. Users that rely on earlier versions (including 3.10.2 through 4.2.0) and import UnixFileLock in environments where a local user can rename files or create hard links under a permissive policy are impacted. Versions 4.2.1 and later contain the fix and are not affected.

A local attacker with rename or hard‑link privileges can exploit this flaw by simply renaming or linking a target file onto the lock path. The attack is straightforward and does not require elevated privileges beyond those needed to perform the rename or link operation. The CVSS score of 6.1 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is local and requires file‑system permissions typically granted to users with file ownership or broader privileges, the risk is confined to environments where such permissions exist. However, the impact—unintentional data loss and permission changes—can be critical in production settings where files are overwritten without awareness.