CVE-2026-112912: filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using SoftFileLock in filelock versions from 3.32.6 through versions before 4.2.1 may be affected. Exploitation also depends on a local platform and directory configuration that follows the swapped symbolic link.
What does an attacker need to exploit this issue?
The attacker needs local access and must be able to swap a symbolic link during SoftFileLock's conditional os.access writability check. The affected node must lack its owner-write bit.
What can an attacker learn?
An attacker can infer whether a chosen path exists and is writable by the lock taker, based on the observable lock acquisition result. The provided information does not indicate integrity or availability impact.
What should be done to remediate the issue?
Upgrade filelock to version 4.2.1, which fixes the issue.