Is CVE-2026-112908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112908 being exploited in the wild.

How severe is CVE-2026-112908?

Medium severity, with a CVSS score of 5.3, published 5 November 2026.

Which products and versions are affected?

filelock (PyPI) >= 3.30.0, <= 4.2.0, ECOSYSTEM:introduced=3.30.0,fixed=4.2.1; Tox-Dev Filelock 3.30.0 through 4.2.0.

How is CVE-2026-112908 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-112908?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112908: filelock StrictSoftFileLock directory permission bypass

Q: Is there a fix for CVE-2026-112908?

Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Run processes that acquire strict locks with umask 022 or 077. Avoid default ACLs granting other accounts write permission on the lock's parent directory. For existing locks already created with overpermissive modes, run chmod -R go-w on the .filelock directory tree while no process holds the lock. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112908 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-112908?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112908 · Severity: medium · CVSS 5.3 · Published 2026-11-05

StrictSoftFileLock is a Python library component that implements file-based mutual exclusion locks to prevent concurrent access to shared resources. When processes use restrictive file permissions (0600) for the lock with a permissive system umask or default ACL, another local user can delete the lock's claim files, allowing a second holder of the lock-owning user's account to enter the critical section simultaneously with the first. This violates the lock's fail-closed guarantee and can lead to data corruption or race conditions in protected code.

Technologies: filelock (PyPI), Tox-Dev Filelock. Vendors: PyPI, Tox-Dev.

Quick answers

Is CVE-2026-112908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112908 being exploited in the wild.
How severe is CVE-2026-112908?: Medium severity, with a CVSS score of 5.3, published 5 November 2026.
Which products and versions are affected?: filelock (PyPI) >= 3.30.0, <= 4.2.0, ECOSYSTEM:introduced=3.30.0,fixed=4.2.1; Tox-Dev Filelock 3.30.0 through 4.2.0.
Is there a fix for CVE-2026-112908?: Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Run processes that acquire strict locks with umask 022 or 077. Avoid default ACLs granting other accounts write permission on the lock's parent directory. For existing locks already created with overpermissive modes, run chmod -R go-w on the .filelock directory tree while no process holds the lock. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112908 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-112908?: Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

filelock (PyPI): upgrade to 4.2.1 or later
```
pip install "filelock>=4.2.1"
```

Run processes that acquire strict locks with umask 022 or 077. Avoid default ACLs granting other accounts write permission on the lock's parent directory. For existing locks already created with overpermissive modes, run chmod -R go-w on the .filelock directory tree while no process holds the lock.

Technical details

StrictSoftFileLock creates lock claim directories using bare mkdir() without applying the caller's requested mode, resulting in permissions of 0777 under permissive umasks or default ACLs. These directories lack sticky bits, allowing other local users with write permission to unlink the holder's claim files (which are 0600). Once unlinked, a competing process of the same owner observes an empty claims directory and enters the critical section, while the original holder remains unaware of the violation. The vulnerability exists in filelock versions 3.30.0 through 4.2.0 and requires an unprivileged local account plus specific umask or ACL conditions on the lock's parent directory.

Affected products

tox-dev filelock 3.30.0 through 4.2.0

Identifiers

CVE-2026-112908
GHSA-6627-m3xw-93mp

Timeline

2026-10-15: disclosed: Vulnerability reported by Anthropic's OSS Scanner (finding ANT-2026-AD6SUOON)
2026-10-16: patched: Fix PR #839 opened
2026-10-28: advisory: GHSA-6627-m3xw-93mp published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.