Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112938— filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

Quick assessment

Affected
tox-dev filelock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

filelock 是一个跨平台的 Python 文件锁库。在 3.30.0 至 4.2.1 版本中，在 POSIX 平台上，StrictSoftFileLock 和 AsyncStrictSoftFileLock 会在 _ensure_protocol_directory 方法中验证协调目录，但随后通过 _open_directory 方法以路径名访问声明目录。这导致一个本地账户可以在检查与使用之间，通过重命名协调目录名称并替换为符号链接，从而在获取锁的过程中实施竞争攻击。该竞争可能导致在另一个可写目录中创建并遗留

CVSS 5.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112938

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
Source: CVE Program / CVE List V5
Vulnerability Description
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
允许符号链接跟随的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tox-dev filelock >= 3.30.0, < 4.2.1 -

II. Public POCs for CVE-2026-112938

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112938

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112938 (1)

Vendor Pages for CVE-2026-112938 (1)

Other References for CVE-2026-112938 (2)

Same Patch Batch · tox-dev · 2026-11-05 · 5 CVEs total

CVE-2026-112908 5.3 MEDIUM filelock: StrictSoftFileLock creates its claim directories without the lock mode, so anoth
CVE-2026-112910 5.3 MEDIUM filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database i
CVE-2026-112913 3.3 LOW filelock: ReadWriteLock on Windows acts on SQLite side files another local user places bes
CVE-2026-112907 2.5 LOW filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past i

IV. Related Vulnerabilities

Same product: filelock
Same vendor: tox-dev
Same weakness: CWE-363