CVE-2026-112908
Publication date 6 November 2026
Last updated 6 November 2026
Ubuntu priority
Description
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python-filelock | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.3 · Medium
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-112908
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp