CVE-2026-112937: medium-severity vulnerability in tox-dev filelock
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected products
tox-dev · filelockRelated CVEs — tox-dev filelock
In the same product, most dangerous first.
CVE-2026-112934MEDIUMfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordEPSS 0.2%CVE-2026-112936MEDIUMfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-112915MEDIUMfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutEPSS 0.2%CVE-2026-112912LOWfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%