CVE-2026-112934: filelock SoftReadWriteLock directory traversal and lock stalling

CVE-2026-112934 · Severity: medium · CVSS 6.1 · Published 2026-10-20

filelock is a Python library for cross-platform file locking. Versions 4.0.0 through 4.2.0 allow local attackers with write access to the lock directory to bypass lock integrity by replacing lock records with named pipes or hard-linked files, causing the lock holder to stall or write through arbitrary files. This could lead to privilege escalation, data corruption, or denial of service for applications relying on filelock for mutual exclusion.

Technologies: filelock (PyPI), Tox-Dev Filelock. Vendors: PyPI, Tox-Dev.

Quick answers

Is CVE-2026-112934 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112934 being exploited in the wild.
How severe is CVE-2026-112934?
Medium severity, with a CVSS score of 6.1, published 20 October 2026.
Which products and versions are affected?
filelock (PyPI) >= 4.0.0, <= 4.2.0, ECOSYSTEM:introduced=4.0.0,fixed=4.2.1; Tox-Dev Filelock 4.0.0 through 4.2.0.
Is there a fix for CVE-2026-112934?
Yes. filelock (PyPI): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112934 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-112934?
Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filelock (PyPI): upgrade to 4.2.1 or later
    pip install "filelock>=4.2.1"

Technical details

SoftReadWriteLock caches directory path checks and subsequently resolves record file paths by name alone, trusting earlier validation. An attacker with write access to the lock directory can rename it aside and replace it with a directory tree where gen or holders are symlinks/junctions, causing subsequent lock operations (create, link, replace, unlink) to operate outside the intended lock tree. The holder heartbeat may write through a named pipe or hard-linked target file, or block indefinitely. The vulnerability requires local access to the lock directory and ability to rename directories, and affects systems with permissive hard-link policies or where attackers can create named pipes.

Affected products

  • tox-dev filelock 4.0.0 through 4.2.0

Identifiers

  • CVE-2026-112934
  • GHSA-fj95-fr6c-h845

Timeline

  • 2026-10-20: disclosed
  • 2026-10-17: patched: commit bfa066d65a1ba9106f86ee9d027f7588b9c77e03

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.