CVE-2025-68146
MediumAdvisory
Published 16 Dec 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 123
- of 17,781 indexed, latest versions
- Container images
- 135
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Carried by container images the latest versions of 123 of 17,781 indexed charts deploy, on 135 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-filelockdeb | 3.9.0-1, 3.13.1-1 | 3.9.0-1+deb12u1, 3.13.1-1ubuntu0.1~esm1 | 6 |
| filelockpypi | 3.0.12, 3.3.2, 3.4.1, 3.4.2+21 more | 3.20.1 | 135 |
- OSV records
- DEBIAN-CVE-2025-68146GHSA-w853-jp5j-5j7fUBUNTU-CVE-2025-68146
- Also known as
- PYSEC-2026-1375, USN-7999-1
Charts affected
123 by stars
Container images carrying it
135 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| kong/ | a6ac46531193 | filelock | 3.20.1 | 1 |
| langgenius/ | 066035f93856 | filelock | 3.20.1 | 1 |
| langgenius/ | fca918260dd6 | filelock | 3.20.1 | 1 |
| lnbitsdocker/ | 26fae6327477 | filelock | 3.20.1 | 1 |
| lnbitsdocker/ | a11aaa6d2b21 | filelock | 3.20.1 | 1 |
| localstack/ | 9d278167f2b7 | filelock | 3.20.1 | 1 |
| milesmcc/ | ba54f7797a6b | filelock | 3.20.1 | 1 |
| milesmcc/ | e821e31140f7 | filelock | 3.20.1 | 1 |
| mshanley80/ | 5b189a70c0fb | filelock | 3.20.1 | 1 |
| oled01/ | 05d3e398e675 | filelock | 3.20.1 | 1 |
| opea/ | 25dd26d9cd09 | filelock | 3.20.1 | 1 |
| opea/ | 262c6048aab8 | filelock | 3.20.1 | 1 |
| opea/ | f68bec6a1271 | filelock | 3.20.1 | 1 |
| opea/ | 02f9e8fa5d71 | filelock | 3.20.1 | 1 |
| opea/ | 249afad3d268 | filelock | 3.20.1 | 1 |
| opea/ | 257ae94709e9 | filelock | 3.20.1 | 1 |
| opea/ | fe08165d7770 | filelock | 3.20.1 | 1 |
| opencsghq/ | 2f03fead54db | filelock | 3.20.1 | 1 |
| opencsghq/ | 2cd29671a03e | filelock | 3.20.1 | 1 |
| opencsghq/ | c36a5bac3cf0 | filelock | 3.20.1 | 1 |
| opencsghq/ | 47e22aa71870 | filelock | 3.20.1 | 1 |
| opencsghq/ | b4e849fcf94a | filelock | 3.20.1 | 1 |
| openmined/ | b72f74a68b32 | filelock | 3.20.1 | 1 |
| openstackhelm/ | f728510bab3c | filelock | 3.20.1 | 1 |
| openstackhelm/ | e07d75953d2e | filelock | 3.20.1 | 1 |
| pangeo/ | 5fbe688a4f80 | filelock | 3.20.1 | 1 |
| pnnlmiscscripts/ | 8af4b7551d40 | filelock | 3.20.1 | 1 |
| pretix/ | 5df3b7aa852e | filelock | 3.20.1 | 1 |
| rdavidoff/ | 7ae4c5135771 | filelock | 3.20.1 | 1 |
| redash/ | 00d813437db5 | filelock | 3.20.1 | 1 |
| redash/ | c5c9148f5c38 | filelock | 3.20.1 | 1 |
| redislabs/ | 33561794c5c8 | filelock | 3.20.1 | 1 |
| runx1/ | 0ca3867d3200 | filelock | 3.20.1 | 1 |
| salehmir/ | 1afa95f979e9 | filelock | 3.20.1 | 1 |
| sruthitanneru/ | e565ea454ffd | filelock | 3.20.1 | 1 |
| stackstorm/ | 88235ba70cad | filelock | 3.20.1 | 1 |
| stackstorm/ | 6f56d239d280 | filelock | 3.20.1 | 1 |
| stackstorm/ | 33ecfda16608 | filelock | 3.20.1 | 1 |
| stackstorm/ | 4e3f8c7ca52d | filelock | 3.20.1 | 1 |
| stackstorm/ | f190a6212195 | filelock | 3.20.1 | 1 |
| stackstorm/ | 259503496ff9 | filelock | 3.20.1 | 1 |
| stackstorm/ | b1de2055c362 | filelock | 3.20.1 | 1 |
| stackstorm/ | b1a338f64773 | filelock | 3.20.1 | 1 |
| stackstorm/ | 1c8904a3bf67 | filelock | 3.20.1 | 1 |
| stackstorm/ | 1bf35bfaf00c | filelock | 3.20.1 | 1 |
| stackstorm/ | 19fdfffdbba8 | filelock | 3.20.1 | 1 |
| statcan/ | 3921305425b8 | filelock | 3.20.1 | 1 |
| timescale/ | e8d0a9cc3db5 | filelock | 3.20.1 | 1 |
| treskon/ | a475d80e4ecf | filelock | 3.20.1 | 1 |
| vabene1111/ | 0f8d061895e9 | filelock | 3.20.1 | 1 |