CVE-2026-112914: medium-severity vulnerability in tox-dev filelock
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected products
tox-dev · filelockRelated CVEs — tox-dev filelock
In the same product, most dangerous first.
CVE-2026-112934MEDIUMfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordEPSS 0.2%CVE-2026-112936MEDIUMfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-112915MEDIUMfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutEPSS 0.2%CVE-2026-112912LOWfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%