This vulnerability allows a local user to influence which directories are used to store lock records when a SoftReadWriteLock or AsyncSoftReadWriteLock obtains a lock. After the first acquisition the lock object caches the lock tree; a subsequent local attacker can swap the lock tree before another operation, causing the lock to write records into a directory of the attacker’s choice. Consequently the attacker can write arbitrary files under a path owned by the user holding the lock, effectively providing local file‑write privileges that could lead to privilege escalation or execution of arbitrary code on the system.

Software affected is the filelock library for Python distributed by tox‑dev. Versions 4.1.0 through 4.2.1 are impacted; the issue is resolved in release 4.2.1.

The CVSS base score is 3.3, indicating low overall severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack requires local access to the same machine and the ability to perform operations that replace the lock tree between lock acquisition and subsequent record writes. Because it involves only local authorization and no network exposure, the risk is confined to environments where multiple local users share the same Python process space.