CVE-2026-112939: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using SoftFileLock in filelock versions from 3.22.0 up to, but not including, 4.2.1 are exposed when an attacker can modify the lock marker while being unable to remove it. Exploitation also requires an authorized contender, such as another process running under the holder's account or root, to act on the forged marker.
Does exploitation require remote access or user interaction?
The supplied CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. The attacker must be able to alter the writable marker's process identifier and rely on an authorized contender to remove the live marker.
What is the impact if the issue is exploited?
A forged PID can cause an authorized contender to remove a live holder's marker, allowing another holder to be admitted while the original holder is still active. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.
What version fixes the issue?
Upgrade filelock to version 4.2.1. The affected range is from version 3.22.0 until 4.2.1.