CVE-2026-112914

Analyzed Analyzed - Analysis Complete

filelock SoftFileLock Symlink Race Condition

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112914

EUVD

EUVD-2026-105020

Affected Vendors & Products

Vendor	Product	Version / Range
tox-dev	filelock	From 4.1.0 (inc) to 4.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-363	The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Attack-Flow Graph

Executive Summary

This vulnerability affects the filelock Python library versions 4.1.0 to 4.2.0. It involves a race condition in the SoftFileLock stale-break restore mechanism where a local attacker can swap a symbolic link into a lock directory after a stale lock is renamed but before the restore completes. This allows the attacker to create a hard link to a file owned by the lock user in the lock directory, potentially leading to integrity issues like file truncation.

Detection Guidance

Check if your system uses filelock versions 4.1.0 to 4.2.0. Run: pip show filelock. If installed, verify version with: python -c "import filelock; print(filelock.__version__)". If vulnerable, update to version 4.2.1 or later.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to manipulate file metadata or cause integrity issues such as file truncation. It requires a shared lock directory without a sticky bit and involves two short races timed by inotify. The attacker does not gain access to file content but can indirectly affect files linked in the lock directory.

Compliance Impact

This vulnerability primarily affects file integrity and access control, which could indirectly impact compliance with standards like GDPR and HIPAA. GDPR requires protecting personal data integrity and preventing unauthorized access, while HIPAA mandates safeguarding protected health information. The race condition could allow unauthorized file manipulation, potentially leading to data integrity issues or unauthorized access, which may violate these regulations if exploited.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately. If using a shared lock directory, ensure it has the sticky bit set to prevent unauthorized file renaming. Monitor for unusual file operations in lock directories.

Hi! I’m here to help you understand CVE-2026-112914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...