Is CVE-2026-112911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112911 being exploited in the wild.

How severe is CVE-2026-112911?

Medium severity, with a CVSS score of 6.3, published 20 October 2026.

Which products and versions are affected?

filelock (PyPI) >= 3.30.0, <= 4.2.0, ECOSYSTEM:introduced=3.30.0,fixed=4.2.1; Tox-Dev Filelock 3.30.0 to 4.2.0 (StrictSoftFileLock); 4.0.0 to 4.2.0 (SoftReadWriteLock).

How is CVE-2026-112911 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-112911?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112911: filelock StrictSoftFileLock directory adoption vulnerability

Q: Is there a fix for CVE-2026-112911?

Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Ensure filelock coordination directories are created on filesystems with sticky-bit protection (such as /tmp on Unix systems); restrict access to shared parent directories where lock files are created to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112911 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-112911?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112911 · Severity: medium · CVSS 6.3 · Published 2026-10-20

filelock is a Python library that manages file locks across processes and platforms. Versions 3.30.0 through 4.2.0 of StrictSoftFileLock and 4.0.0 through 4.2.0 of SoftReadWriteLock can be exploited by another local user to hijack the protocol coordination directory, allowing that user to interfere with lock state and admit unauthorized concurrent access to protected resources. An attacker with local access on a shared system could escalate this to data corruption or exposure.

Technologies: filelock (PyPI), Tox-Dev Filelock. Vendors: PyPI, Tox-Dev.

Quick answers

Is CVE-2026-112911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112911 being exploited in the wild.
How severe is CVE-2026-112911?: Medium severity, with a CVSS score of 6.3, published 20 October 2026.
Which products and versions are affected?: filelock (PyPI) >= 3.30.0, <= 4.2.0, ECOSYSTEM:introduced=3.30.0,fixed=4.2.1; Tox-Dev Filelock 3.30.0 to 4.2.0 (StrictSoftFileLock); 4.0.0 to 4.2.0 (SoftReadWriteLock).
Is there a fix for CVE-2026-112911?: Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Ensure filelock coordination directories are created on filesystems with sticky-bit protection (such as /tmp on Unix systems); restrict access to shared parent directories where lock files are created to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112911 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-112911?: Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

filelock (PyPI): upgrade to 4.2.1 or later
```
pip install "filelock>=4.2.1"
```

Ensure filelock coordination directories are created on filesystems with sticky-bit protection (such as /tmp on Unix systems); restrict access to shared parent directories where lock files are created to trusted users only.

Technical details

The vulnerability stems from StrictSoftFileLock creating the claims directory without proper ownership checks and SoftReadWriteLock failing to validate directory ownership on sticky-bit parent directories like /tmp. A local user can create the coordination directory first, and a subsequent lock holder will adopt it, allowing the first user to alter lock protocol state and inject concurrent access. The flaw affects the protocol directory adoption logic, permitting unauthorized modification of lock claims.

Affected products

tox-dev filelock 3.30.0 to 4.2.0 (StrictSoftFileLock); 4.0.0 to 4.2.0 (SoftReadWriteLock)

Identifiers

CVE-2026-112911
GHSA-9c4x-gm8v-wgc4

Timeline

2026-10-20: disclosed
2026-10-17: patched: Fix committed; version 4.2.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.