CVE-2026-112914: filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Exposure requires SoftFileLock to use a non-sticky lock directory where another local user has rename access. The runtime must follow the substituted symbolic link, and the targeted file must be on the same filesystem as the lock directory.
What access does an attacker need?
An attacker needs local access and the ability to rename entries in the non-sticky directory used for locks. They must be able to race the stale-marker restoration by swapping in a symbolic link.
What versions should be remediated?
The issue affects filelock versions from 4.1.0 up to the fix in 4.2.1. Upgrade to version 4.2.1.