CVE-2026-112908

Full vulnerability record from the local CVENow database.

Description

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

Severity

MEDIUM

CVSS score

5.3 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 22:17:46.693000

Last modified

2026-11-05 22:17:46.693000

View original CVE JSON

{
  "id": "CVE-2026-112908",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T22:17:46.693",
  "lastModified": "2026-11-05T22:17:46.693",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "tox-dev",
          "product": "filelock",
          "versions": [
            {
              "version": ">= 3.30.0, < 4.2.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 4.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tox-dev/filelock/pull/839",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp",
      "source": "[email protected]"
    }
  ]
}