CVE-2026-112908

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

• CWE-732

• https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde
• https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
• https://github.com/tox-dev/filelock/pull/839
• https://github.com/tox-dev/filelock/releases/tag/4.2.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112901Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…7.5
• CVE-2026-112902Pillow is a Python imaging library. In versions through 12.3…8.3
• CVE-2026-112904Vvveb is a powerful and easy to use CMS with page builder to…8.7
• CVE-2026-112905Vvveb is a powerful and easy to use CMS with page builder to…9
• CVE-2026-112906filelock is a platform-independent file lock for Python. Fro…4.7
• CVE-2026-112907filelock is a platform-independent file lock for Python. Fro…2.5
• CVE-2026-112909filelock is a platform-independent file lock for Python. Pri…6.1
• CVE-2026-11291Inappropriate implementation in Android Autofill in Google C…4.3
• CVE-2026-112910filelock is a platform-independent file lock for Python. Fro…5.3
• CVE-2026-112911filelock is a platform-independent file lock for Python. Fro…6.3
• CVE-2026-112912filelock is a platform-independent file lock for Python. Fro…2.5
• CVE-2026-112913filelock is a platform-independent file lock for Python. Fro…3.3