CVE-2026-112911

Published: Oct 20, 2026Modified: Oct 21, 2026

6.3

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.0 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.

Affected (1)

Products: Tox Dev: Filelock

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tox Dev Filelock	3.30.0 ≤ version < 4.2.1

Related CWEs

Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

References (4)

https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03

Source: security-advisories@github.com

Patch

https://github.com/tox-dev/filelock/pull/839

Source: security-advisories@github.com

Patch

https://github.com/tox-dev/filelock/releases/tag/4.2.1

Source: security-advisories@github.com

Release Notes

https://github.com/tox-dev/filelock/security/advisories/GHSA-9c4x-gm8v-wgc4

Source: security-advisories@github.com

ExploitMitigationPatchVendor Advisory

Timeline

No history available yet.