Symlink race in filelock StrictSoftFileLock writes claims elsewhere
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
filelock for Python, from 3.30.0 before 4.2.1, follows symbolic links in StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX platforms. A race between directory validation and use lets a local account that can rename the coordination name swap in a symbolic link and create claim files in another writable directory (CWE-363). The claims property and force_break also follow a resting symbolic link, and a blind force_break can let two processes into another strict lock's critical section.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tox-dev | filelock | 3.30.0 to before 4.2.1 | 4.2.1 | Patch available | CNA |
| — | filelock (PyPI) | 3.30.0 to before 4.2.1 | 4.2.1 | Patch available | GHSA-m462-7rxw-wvpg |
- filelock Vendortox-dev Affected 3.30.0 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
- filelock (PyPI) Vendor— Affected 3.30.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-m462-7rxw-wvpg
Remediation
Upgrade filelock to version 4.2.1, the fixed version listed for both the tox-dev and PyPI entries. Red Hat lists one product as not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA filelock (tox-dev) Fixed in 4.2.1
- Fix · GHSA-m462-7rxw-wvpg filelock (PyPI) Fixed in 4.2.1 Advisory →
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-112938
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/tox-dev/filelock
More tox-dev vulnerabilities
- TI-2026-76862 Symlink race in filelock ReadWriteLock lets attackers overwrite files CVSS 3.1HIGH 7.1
- TI-2026-76853 filelock soft locks adopt directories created by other local users CVSS 3.1MEDIUM 6.3
- TI-2026-76859 Symlink following in filelock ReadWriteLock redirects SQLite database CVSS 3.1MEDIUM 6.1
- TI-2026-76857 Unsafe holder record refresh in filelock SoftReadWriteLock CVSS 3.1MEDIUM 6.1
- TI-2026-76852 filelock UnixFileLock truncates files placed on the lock path CVSS 3.1MEDIUM 6.1
- TI-2026-76856 Crafted lock database makes filelock ReadWriteLock acquisitions hang CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-112938 · CVE Program
- CVE-2026-112938 · NVD
- FIRST EPSS
- CVE-2026-112938 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences