← Back

CVE-2026-112934

nvd nist
Published: Oct 20, 2026Modified: Oct 22, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Exploitability: 1.8 / Impact: 4.2
Source: security-advisories@github.com (Secondary)

Description

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

Affected (1)

Products: Tox Dev: Filelock
Tox Dev
1 product
Filelock
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Filelock
4.0.0 ≤ version < 4.2.1

Related CWEs

CWE-62
UNIX Hard Link
The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

References (5)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
ExploitMitigationVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitMitigationVendor Advisory

Timeline

No history available yet.