PT-2026-118392

Name of the Vulnerable Software and Affected Versions filelock versions 3.30.0 through 4.2.0 Description StrictSoftFileLock and SoftReadWriteLock can adopt a protocol directory created by another local user within a shared parent directory. This allows the other user to modify the protocol state...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition issue. This issue stemmed from the SoftReadWriteLock and AsyncSoftReadWriteLock classes’ caching mechanism for checking the .rw lock tree successfully, and then re-reshaping its name during subsequent recording operations. This coul...

tox-dev filelock: Permissions, permission grants, and access control issues

The tox-dev filelock version 3.30.0 to 4.2.1 had vulnerabilities related to permission handling and access control. These vulnerabilities stemmed from the use of StrictSoftFileLock version 3.30.0 and later, as well as SoftReadWriteLock version 4.0.0 and later. These versions may use a protocol...

tox-dev filelock backend link vulnerability

In versions of tox-dev FileLock from 4.0.0 to 4.2.1, there was a post-processing link vulnerability. This vulnerability stemmed from SoftReadWriteLock’s mechanism for refreshing holder records by name. Local users with permission to rename lock directories could replace the records with named...