Monthly
filelock's SQLite-backed ReadWriteLock (versions 3.20.4 through 4.2.0) can be tricked into overwriting or unlinking the side files SQLite keeps next to a locked database, and - when a writable hot journal is also present - into writing attacker-chosen content into that database. This is a genuine but conditional local-privilege issue rather than a widespread remote threat: it requires an existing low-privileged local account with rename/write access in a non-sticky parent directory at or above the database path, and it is a timing-sensitive race that does not apply when every parent directory is owned by the locking account or root and is either non-group/other-writable or carries the sticky bit. No public exploit identified at time of analysis and no CISA KEV entry; vendor-released patch: 4.2.1.
Symlink-following in the Python filelock package's StrictSoftFileLock and AsyncStrictSoftFileLock (versions 3.30.0 through 4.2.0) allows a second local account that can rename the `<path>.filelock` coordination directory to redirect the lock user's `claims` directory creation, claim publication and cleanup into any directory that user can write. The attacker lands the swap between the `lstat` check and the following `mkdir` by looping `renameat2(RENAME_EXCHANGE)`, and wins after roughly 1 to 31 runs of a repeatedly-acquired lock; the payoff is directory and claim-file creation with the lock user's privileges, limited file-name disclosure from a private directory through the `claims` property, and - when the link targets another strict lock's `.filelock` directory - stranded claims that deny that lock to every process until an operator force-breaks each one. The impact is local-only, POSIX/Linux-demonstrated, requires a high-complexity race window in a directory the attacker can rename, and yields no code execution; a reproducer accompanies the upstream advisory, and vendor-released patch 4.2.1 closes the issue.
A local, low-privileged user (PR:L) who can rename files in a shared, non-sticky-bit lock directory can abuse the Python filelock package's SoftFileLock, MarkerSoftFileLock, or SoftFileLease marker-restore path in versions 4.1.0 through 4.2.0 to make the lock owner hard-link one of its own files into the lock directory, exposing file contents and causing limited integrity impact. The race is high-complexity and timing-dependent, requires a second local account plus a non-default shared-directory configuration, and no public exploit code has been identified at the time of analysis. All signals point to a genuinely low operational priority despite the MEDIUM 5.3 CVSS.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local privilege escalation in HP Image Assistant versions prior to 5.3.3 requires an attacker to already hold a low-privileged local account and win a race condition while the tool installs packages. Although the impact metrics are high, exploitation is constrained: it is not remote, requires a package installation event and user interaction, and depends on a non-deterministic timing window. EPSS is 0.02% (3rd percentile), no public exploit identified at time of analysis, and HP has released a fixed version (5.3.3).
filelock's SQLite-backed ReadWriteLock (versions 3.20.4 through 4.2.0) can be tricked into overwriting or unlinking the side files SQLite keeps next to a locked database, and - when a writable hot journal is also present - into writing attacker-chosen content into that database. This is a genuine but conditional local-privilege issue rather than a widespread remote threat: it requires an existing low-privileged local account with rename/write access in a non-sticky parent directory at or above the database path, and it is a timing-sensitive race that does not apply when every parent directory is owned by the locking account or root and is either non-group/other-writable or carries the sticky bit. No public exploit identified at time of analysis and no CISA KEV entry; vendor-released patch: 4.2.1.
Symlink-following in the Python filelock package's StrictSoftFileLock and AsyncStrictSoftFileLock (versions 3.30.0 through 4.2.0) allows a second local account that can rename the `<path>.filelock` coordination directory to redirect the lock user's `claims` directory creation, claim publication and cleanup into any directory that user can write. The attacker lands the swap between the `lstat` check and the following `mkdir` by looping `renameat2(RENAME_EXCHANGE)`, and wins after roughly 1 to 31 runs of a repeatedly-acquired lock; the payoff is directory and claim-file creation with the lock user's privileges, limited file-name disclosure from a private directory through the `claims` property, and - when the link targets another strict lock's `.filelock` directory - stranded claims that deny that lock to every process until an operator force-breaks each one. The impact is local-only, POSIX/Linux-demonstrated, requires a high-complexity race window in a directory the attacker can rename, and yields no code execution; a reproducer accompanies the upstream advisory, and vendor-released patch 4.2.1 closes the issue.
A local, low-privileged user (PR:L) who can rename files in a shared, non-sticky-bit lock directory can abuse the Python filelock package's SoftFileLock, MarkerSoftFileLock, or SoftFileLease marker-restore path in versions 4.1.0 through 4.2.0 to make the lock owner hard-link one of its own files into the lock directory, exposing file contents and causing limited integrity impact. The race is high-complexity and timing-dependent, requires a second local account plus a non-default shared-directory configuration, and no public exploit code has been identified at the time of analysis. All signals point to a genuinely low operational priority despite the MEDIUM 5.3 CVSS.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local privilege escalation in HP Image Assistant versions prior to 5.3.3 requires an attacker to already hold a low-privileged local account and win a race condition while the tool installs packages. Although the impact metrics are high, exploitation is constrained: it is not remote, requires a package installation event and user interaction, and depends on a non-deterministic timing window. EPSS is 0.02% (3rd percentile), no public exploit identified at time of analysis, and HP has released a fixed version (5.3.3).