Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112908— filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

Quick assessment

Affected
tox-dev filelock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

filelock 是一个跨平台的 Python 文件锁工具。在 3.30.0 至 4.2.1 版本中，POSIX 系统上的 StrictSoftFileLock 和 AsyncStrictSoftFileLock 在创建协调目录和声明目录时，未应用调用方指定的限制性锁模式。若系统设置了宽松的 umask 或继承了默认访问控制列表（ACL），这些目录可能对其他本地用户可写，从而允许该用户删除当前锁持有者的声明文件。此时，另一个授权进程可在原持有者仍处于临界区时获取该锁。此外，攻击者还可植入格式错误的声明文件以阻止锁的

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112908

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
Source: CVE Program / CVE List V5
Vulnerability Description
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tox-dev filelock >= 3.30.0, < 4.2.1 -

II. Public POCs for CVE-2026-112908

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112908

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112908 (1)

Vendor Pages for CVE-2026-112908 (1)

Other References for CVE-2026-112908 (2)

Same Patch Batch · tox-dev · 2026-11-05 · 5 CVEs total

CVE-2026-112938 5.8 MEDIUM filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and cre
CVE-2026-112910 5.3 MEDIUM filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database i
CVE-2026-112913 3.3 LOW filelock: ReadWriteLock on Windows acts on SQLite side files another local user places bes
CVE-2026-112907 2.5 LOW filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past i

IV. Related Vulnerabilities

Same product: filelock
Same vendor: tox-dev
Same weakness: CWE-732