File Lock Vulnerability in Python Management Software by Tox Dev

CVE-2026-112940

What is CVE-2026-112940?

A vulnerability exists in Tox Dev's filelock, a Python-based file locking system, where an attacker can exploit the ReadWriteLock feature between versions 3.20.4 and 4.2.1. The issue arises due to improper handling of SQLite database reopening on POSIX systems, allowing an attacker with rename access in a non-sticky parent directory to manipulate file names. This can result in unintended file overwrite or deletion, especially when there is a writable adjacent hot journal, permitting the possibility to overwrite content of the attacker's choice. The vulnerability has been resolved in filelock version 4.2.1.

References