File Lock Vulnerability in Tox FileLock for Python Affects Multiple Versions

CVE-2026-112938

What is CVE-2026-112938?

FileLock, a platform-independent file locking mechanism for Python, has a vulnerability affecting versions from 3.30.0 to 4.2.1. This issue arises on POSIX platforms where the mechanisms, StrictSoftFileLock and AsyncStrictSoftFileLock, fail to properly validate the coordination directory during the lock acquisition process. A local account can potentially exploit this vulnerability by renaming the coordination directory, allowing them to introduce a symbolic link between the check and use phases. Consequently, this race condition can result in unintended file claims across writable directories, leading to the possibility of two processes accessing the same critical section of code. Furthermore, inspection of claims properties could inadvertently disclose sensitive file names to unauthorized accounts via shared logs or error reports. This vulnerability has been addressed in version 4.2.1 of FileLock.

References