CVE-2026-112941: filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using filelock versions 4.1.0 through 4.2.1 are affected when they use SoftReadWriteLock or AsyncSoftReadWriteLock and another local user can replace the <path>.rw lock tree after the lock is first acquired.
What access does an attacker need?
An attacker needs local access and the ability to replace the lock tree after a successful initial acquisition. Exploitation redirects subsequent lock-record writes into directories writable by the user running the lock.
Is there a fixed version?
Yes. The issue is fixed in filelock version 4.2.1.
What can be done before updating?
Restrict other local users from replacing or modifying the <path>.rw lock tree used by SoftReadWriteLock or AsyncSoftReadWriteLock. Avoid using these lock types in locations where untrusted local users can alter the lock tree.