File Truncation Vulnerability in Python's FileLock by Tox Dev
CVE-2026-112909

6.1MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112909?

The FileLock library for Python, particularly prior to version 4.2.1, is susceptible to a vulnerability where UnixFileLock may unintentionally truncate a regular file when renamed onto the lock path by a user with sufficient privileges. This flaw arises when the file lock is exploited through local user permissions or permissive hard-link policies, potentially leading to unauthorized file modifications or data loss. The flaw is rectified in version 4.2.1, emphasizing the importance of using updated versions to ensure file integrity.

Affected Version(s)

filelock < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/835
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/e1e825b1992f69...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.