Symbolic Link Vulnerability in SoftFileLock Affects Python File Locking
CVE-2026-112912

2.5LOW

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112912?

The filelock library, used for managing file locks in Python applications, presents a vulnerability in versions 3.32.6 to 4.2.1. Specifically, the SoftFileLock feature may incorrectly process swapped symbolic links during the os.access writability check of a node, which is not owned by the user. This flaw allows potential unauthorized users to determine the existence and writability of a path via observable results, posing a risk to file system integrity. Users are strongly advised to upgrade to version 4.2.1, where this issue is addressed effectively.

Affected Version(s)

filelock >= 3.32.6, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/835
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/e1e825b1992f69...
x_refsource_MISC

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.