DEBIAN-CVE-2026-112908: Debian/python-filelock vulnerability

Published Nov 5, 2026

Updated

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

Affected Software

3 affected components

debian/python-filelock*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade filelock to a version that resolves this vulnerability.
Fixed in 4.2.1

Frequently Asked Questions

Who is exposed to this issue?

POSIX deployments using StrictSoftFileLock or AsyncStrictSoftFileLock are affected if the process has a permissive umask or inherits a default ACL that lets another local user write the lock coordination or claim directories. The issue affects filelock versions from 3.30.0 through before 4.2.1.

What does an attacker need to exploit it?

The attacker needs local access as another user able to write the lock directories because of their resulting permissions or ACLs. They can delete active claims so another authorized process acquires the lock during the original holder's critical section, or plant malformed claims to block lock acquisition.

Are default installations necessarily affected?

No. Exploitation depends on a permissive umask or inherited default ACL causing the coordination and claim directories to be writable by another local user. The provided information does not establish that this condition exists by default.

What can be done if upgrading is not immediately possible?

Ensure the lock coordination and claim directories are not writable by other local users by using a restrictive umask and avoiding inherited default ACLs that grant such write access. Upgrade to filelock 4.2.1 when possible.

DEBIAN-CVE-2026-112908: Debian/python-filelock vulnerability

Affected Software

Remediation

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations necessarily affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations necessarily affected?

What can be done if upgrading is not immediately possible?