File Lock Permission Bypass in Python filelock

Executive Summary

This vulnerability in the filelock library (CVE-2026-112909) allows a local attacker to truncate or alter files by renaming or hard-linking them to the lock path. UnixFileLock, when acquiring a lock, empties the file at the lock path and may change its permissions. An attacker with local access can exploit this by manipulating file names or links to target files owned by the lock user.

Useful 0 Not Useful 0

Detection Guidance

Check if filelock version 4.2.1 or later is installed. Run: pip show filelock. If version is <=4.2.0, the system is vulnerable. Inspect lock file handling in applications using filelock. Look for unexpected file truncation or permission changes in directories where filelock is used.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to data loss for files owned by the lock user. If an explicit permissive mode (like 0o666) is used, attackers could read and modify subsequent writes to the file. The attack requires local access and specific filesystem conditions but does not need user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately. Update all dependencies in your project to ensure compatibility. Review filelock usage in your code to confirm no explicit permissive modes (e.g., 0o666) are set. Monitor file system activity in directories where filelock operates for suspicious rename or hard-link operations.

Useful 0 Not Useful 0