SoftFileLock performs a writability check by following a symbolic link that a local user can place ahead of the target path. When the link is swapped during the check, the library follows the new target before verifying ownership bits, allowing the user to deduce whether the intended path exists and is writable based on whether the lock acquisition succeeds. This information disclosure permits a local attacker to discover files or directories they cannot normally see, and potentially use that knowledge to influence subsequent operations. The weakness is rooted in CWE‑59, untrusted symbolic‑link handling.

The filelock library, maintained by tox-dev, is affected in all releases from version 3.32.6 up to but not including 4.2.1. These versions expose the SoftFileLock component to local symlink manipulation on platforms that permit symbolic link traversal. Users who rely on filelock for concurrency control or protection of temporary resources should identify whether their deployed version falls within this range.

With a CVSS score of 2.5, the vulnerability is assessed as low severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The exploit requires a local user with the ability to create or alter symbolic links in directories that filelock accesses; no remote or authenticated access is required. The observable outcome is a boolean result of the lock attempt, which gives the attacker indirect knowledge of path existence and writability. While the impact is limited to information disclosure, it can aid future attacks that rely on knowing file locations.