File Lock Vulnerability in Filelock Software by Tox Development
CVE-2026-112941

3.3LOW

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112941?

The Filelock library, a Python tool for managing file locks, has a vulnerability that allows a local user to exploit a caching flaw in the SoftReadWriteLock and AsyncSoftReadWriteLock mechanisms. In versions 4.1.0 through 4.2.1, these components cache successful lock checks on a specified path. If an attacker replaces the lock tree during subsequent record operations, they can redirect the resulting lock-record writes to directories that are writable by the user holding the lock. This has implications for unauthorized writing and potential data integrity issues. The vulnerability is addressed in version 4.2.1.

Affected Version(s)

filelock >= 4.1.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/842
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9...
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.