File Locking Vulnerability in SoftReadWriteLock by Tox Dev

CVE-2026-112934

What is CVE-2026-112934?

The filelock library, utilized for managing file locks in Python, has a vulnerability in the SoftReadWriteLock component affecting versions from 4.0.0 to 4.2.1. The issue arises from the way holder records are refreshed by name, which can be exploited by local users who have rename access to the lock directory. This allows them to replace a record with a named pipe, effectively stalling the lock. In cases where a permissive hard-link policy is in place, an attacker could link to a reachable target file and manipulate the lock user’s operations, potentially compromising data integrity. It is crucial to upgrade to version 4.2.1 or later, where this issue has been resolved.

References