CVE-2026-112941
Received Received - Intake

Soft Link Redirection in Python filelock Library

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112941
EUVD
EUVD-2026-105032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tox-dev filelock >= 4.1.0, < 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the filelock Python library versions 4.1.0 to 4.2.0. It involves SoftReadWriteLock and AsyncSoftReadWriteLock caching a successful check of the lock directory path. An attacker with local access can replace the directory after the first lock acquisition, redirecting subsequent lock-record writes to directories they control. This allows manipulation of files in those directories, potentially causing corruption or denial of service.

Detection Guidance

Check if your system uses filelock versions 4.1.0 to 4.2.0. Run: pip show filelock. If installed, verify version and update to 4.2.1 or later. Inspect directories used by filelock for unexpected symbolic links or file modifications.

Impact Analysis

If exploited, this vulnerability could allow an attacker to corrupt or modify files in directories owned by the lock user, such as a .git directory. This might break repositories, cause data loss, or disrupt applications relying on the filelock library. The attack requires local access and the ability to write to the lock's parent directory.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately. Review directories used by filelock for unauthorized symlinks or file changes. Ensure directories have proper permissions and sticky bits set to prevent unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart