File Locking Vulnerability in SoftFileLock for Python by Tox Dev
CVE-2026-112935

4.7MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112935?

A vulnerability in SoftFileLock from versions 3.22.0 to 4.2.1 allows an attacker to manipulate stale markers. By releasing their own marker after a stale read, an attacker can create a live successor on a reused inode. If the modified time of the successor is not newer than the previously observed one, the live marker may be removed, leading to both the attacker and an honest participant holding valid markers simultaneously. This security flaw compromises the integrity of file locking mechanisms, potentially resulting in unauthorized access to shared resources. Users are advised to upgrade to version 4.2.1 where this issue has been addressed.

Affected Version(s)

filelock >= 3.22.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/843
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/740ff666b62a88...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.