CVE-2026-112911
Received Received - Intake

Strict File Lock Protocol Bypass in filelock

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112911
EUVD
EUVD-2026-105018

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tox-dev filelock >= 3.30.0, < 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-283 The product does not properly verify that a critical resource is owned by the proper entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112911 is a vulnerability in the filelock Python library affecting versions 3.30.0 to 4.2.0. It allows local users to manipulate lock directories and claim files due to improper ownership checks and permission handling. Attackers can create protocol directories before legitimate users, leading to unauthorized claim deletion or interference with lock mechanisms.

Detection Guidance

Check for filelock versions between 3.30.0 and 4.2.0. Inspect protocol directories like .filelock/claims or .rw/{gen,holders} for unexpected ownership or symlinks. Use commands like 'pip show filelock' to verify version and 'ls -la /tmp/.filelock' to check directory permissions and ownership.

Impact Analysis

This vulnerability can lead to unauthorized file modifications, denial-of-service via resource exhaustion, or privilege escalation. Attackers could bypass mutual exclusion, causing two processes to access shared resources simultaneously. It may also cause system crashes or file system corruption due to improper lock handling.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later. Ensure protocol directories are owned by the correct user and have strict permissions (e.g., 0o700). Avoid using sticky directories like /tmp for locks. Monitor for unusual lock behavior or file descriptor leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart