File Lock Vulnerability in SoftFileLock Affecting Tox Dev's Python Library
CVE-2026-112914

5.3MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112914?

SoftFileLock is a cross-platform file locking mechanism in Python, but versions from 4.1.0 to 4.2.1 have a vulnerability that allows a local user with rename access to exploit stale markers. By rearranging symbolic links in a non-sticky lock directory, an attacker can forcibly hard-link files into the lock directory. This flaw can pose significant risk as it allows unauthorized file manipulation under certain conditions. The issue is resolved in version 4.2.1 of the product.

Affected Version(s)

filelock >= 4.1.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/843
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/740ff666b62a88...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.