Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-112908filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

Medium 5.3

In plain English

A medium-severity incorrect permission assignment in filelock from tox-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 98.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-filelockno fix listedDEBIAN-CVE-2026-112908
Debian:13python-filelockno fix listedDEBIAN-CVE-2026-112908
Debian:14python-filelockno fix listedDEBIAN-CVE-2026-112908
PyPIfilelock4.2.1GHSA-6627-m3xw-93mp
Ubuntu:26.04:LTSpython-filelockno fix listedUBUNTU-CVE-2026-112908
Ubuntu:26.10python-filelockno fix listedUBUNTU-CVE-2026-112908

Affected products (as reported)

VendorProductVersions
tox-dev filelock >= 3.30.0, < 4.2.1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

References