CVE-2026-112912

The filelock Python library (versions 3.32.6 until 4.2.1) is vulnerable to a symlink swap during the SoftFileLock writability check. An attacker can manipulate symbolic links to cause the os.access check to follow a swapped link for a node lacking the owner-write bit. This allows a local user to ...

CVE-2026-112912 filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that...

CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906

The filelock Python library (versions 4.1.0 through 4.2.1 ) is vulnerable to a flaw in SoftFileLock where it may reuse a stale observation from another local user's file through inode reuse . If an attacker pre-dates and removes their own marker, and specific conditions regarding modification tim...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

PT-2026-118400

Name of the Vulnerable Software and Affected Versions filelock versions 3.22.0 through 4.2.0 Description SoftFileLock trusts a forged process identifier within a marker. An attacker who can modify but not remove this marker can cause an authorized contender, such as root or another process under...

PT-2026-118397

Name of the Vulnerable Software and Affected Versions filelock versions 3.22.0 through 4.2.0 Description In the SoftFileLock implementation, a race condition exists where a stale marker can be broken. This occurs if an attacker frees their own marker after a stale read, and a legitimate contender...

PT-2026-118393

Name of the Vulnerable Software and Affected Versions filelock versions 3.32.6 through 4.2.0 Description SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit. This allows a local user, on specific platform and...

PT-2026-118394

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock component, the software can restore a stale marker by name after moving it aside. This allows a local user with rename access in a non-sticky lock directory to replace the...

tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

tox-dev filelock: race condition issue

The tox-dev filelock version 3.22.0 up to version 4.2.1 has a race condition vulnerability. This vulnerability arises from race conditions in SoftFileLock, where the active marker may be removed after reading an outdated marker, allowing both holders of the lock to obtain the lock at the same tim...

tox-dev filelock: Input validation error vulnerability

The tox-dev filelock version 3.22.0 to 4.2.1 prior to version 4.2.1 has a vulnerability related to input validation errors. This vulnerability stems from a forged process identifier in the SoftFileLock trust mark, which can be modified by an attacker. This could allow authorized actors to act as ...

tox-dev filelock backend link vulnerability

The tox-dev filelock version 3.32.6 up to version 4.2.1 has a post-processing link vulnerability. This vulnerability arises from SoftFileLock’s handling of symbolic links when checking the writeability of nodes without owner write permissions. It may allow local users to infer whether the selecte...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition vulnerability. This vulnerability stemmed from SoftFileLock’s ability to restore files by their name after removing an outdated marker. This allowed local users with rename privileges in non-sticky lock directories to replace symbol...

Amazon Linux 2023 : python3.13-filelock (ALAS2023-2026-1411)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1411 advisory. filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrar...

SUSE SLED15 / SLES15 Security Update : python-filelock (SUSE-SU-2026:0335-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0335-1 advisory. - CVE-2026-22701: Fixed TOCTOU race condition in SoftFileLock implementation of he filelock package bsc1256457 Tenable...

SUSE-SU-2026:0335-1 Security update for python-filelock

This update for python-filelock fixes the following issues: - CVE-2026-22701: Fixed TOCTOU race condition in SoftFileLock implementation of he filelock package bsc1256457...