CVE-2026-112911: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using StrictSoftFileLock from 3.30.0 through versions before 4.2.1, or SoftReadWriteLock from 4.0.0 through versions before 4.2.1, are exposed when their lock protocol directory is under a parent directory shared with another local user.
What does an attacker need to exploit it?
The attacker needs local access and the ability to create the protocol directory before the affected lock implementation does in a shared parent directory. They can then alter protocol state and cause concurrent lock holders to be admitted.
What is the impact if exploitation succeeds?
Mutual exclusion can be lost, allowing multiple holders to operate concurrently despite the lock. This can compromise integrity and availability of operations that rely on the lock for coordination.
What should be done if upgrading is not immediately possible?
Avoid placing the protocol directory in a parent directory writable by other local users. Ensure the directory is created and controlled only by the user or service using the lock.
How can I remediate the issue?
Upgrade filelock to version 4.2.1, which fixes the issue.