CVE-2026-112934: filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
Published Oct 20, 2026
·Updated
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.
Affected Software
1 affected component
pypi/filelock>=4.0.0<4.2.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Oct 20, 2026
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which filelock versions should be upgraded?
Versions from 4.0.0 up to, but not including, 4.2.1 are affected. Upgrade to version 4.2.1, which fixes the issue.