What is CVE-2026-112914?

CVE-2026-112914 is a medium-severity vulnerability in Tox-Dev Filelock, classified under Race Condition Enabling Link Following. CVSS score: 5.3/10. Published 2026-10-20.

How severe is CVE-2026-112914?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Tox-Dev Filelock

CVE-2026-112914

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.

Published 2026-10-20.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Tox-Dev Filelock — versions >= 4.1.0, < 4.2.1

Weakness classification (CWE)

CWE-363 — Race Condition Enabling Link Following

References

Frequently asked questions

What is CVE-2026-112914?: CVE-2026-112914 is a medium-severity vulnerability in Tox-Dev Filelock, classified under Race Condition Enabling Link Following. CVSS score: 5.3/10. Published 2026-10-20.
How severe is CVE-2026-112914?: Medium severity. CVSS v3 base score is 5.3 out of 10.