← Back

CVE-2026-112937

nvd nist
Published: Oct 20, 2026Modified: Oct 21, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Exploitability: 1.8 / Impact: 4.2
Source: security-advisories@github.com (Secondary)

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

Affected (1)

Products: Tox Dev: Filelock
Tox Dev
1 product
Filelock
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Filelock
4.1.0 ≤ version < 4.2.1

Related CWEs

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
ExploitMitigationPatchVendor Advisory

Timeline

No history available yet.