Vulnerability in Tox-Dev Filelock
CVE-2026-112908
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Tox-Dev Filelock — versions >= 3.30.0, < 4.2.1
Weakness classification (CWE)
References
- https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp
Frequently asked questions
- What is CVE-2026-112908?
- CVE-2026-112908 is a medium-severity vulnerability in Tox-Dev Filelock, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 5.3/10. Published 2026-11-05.
- How severe is CVE-2026-112908?
- Medium severity. CVSS v3 base score is 5.3 out of 10.