CVE-2026-112914
Received Received - Intake

filelock SoftFileLock Symlink Race Condition

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112914
EUVD
EUVD-2026-105020

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tox-dev filelock >= 4.1.0, < 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-363 The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the filelock Python library versions 4.1.0 to 4.2.0. It involves a race condition in the SoftFileLock stale-break restore mechanism where a local attacker can swap a symbolic link into a lock directory after a stale lock is renamed but before the restore completes. This allows the attacker to create a hard link to a file owned by the lock user in the lock directory, potentially leading to integrity issues like file truncation.

Detection Guidance

Check if your system uses filelock versions 4.1.0 to 4.2.0. Run: pip show filelock. If installed, verify version with: python -c "import filelock; print(filelock.__version__)". If vulnerable, update to version 4.2.1 or later.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to manipulate file metadata or cause integrity issues such as file truncation. It requires a shared lock directory without a sticky bit and involves two short races timed by inotify. The attacker does not gain access to file content but can indirectly affect files linked in the lock directory.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately. If using a shared lock directory, ensure it has the sticky bit set to prevent unauthorized file renaming. Monitor for unusual file operations in lock directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112914. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart