SoftFileLock, a cross‑platform file lock for Python, can accept a forged process identifier in a marker file when the marker is writable. An attacker who can create or modify this marker can, without removing it, delegate to another process running under the same account or root to delete the live marker. The attack allows the new process to claim the lock that is actually held by a different process, potentially leading to unauthorized access, data corruption, or denial of service. The weakness is an authorization bypass through a user controlled key (CWE‑345).

The vulnerability affects tox‑dev filelock versions 3.22.0 through 4.2.1. Upgrading to version 4.2.1 or later resolves the issue. No specific workaround is provided by the vendor.

The CVSS score of 4.7 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker needs the ability to create or write to the lock marker file, which typically requires the same Unix user that owns the lock or root privileges. The exploit could result in a confused deputy scenario but does not grant remote code execution. The moderate risk combined with the need for local access means that the vulnerability is significant for systems that rely on the lock for critical coordination but is less urgent than higher severity flaws.