CVE-2026-112937

Overview

The filelock library (Python) version 4.1.0‑4.2.1 allows a local user to delete or rename sibling directories during cleanup of a randomized .filelock‑* private‑hard‑link directory. This can lead to accidental data loss or application disruption. The issue is fixed in version 4.2.1.

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

Impact

Confidentiality: local users may observe or manipulate live lock names, potentially exposing sensitive directory structures. Integrity: a malicious user can delete or rename sibling directories, corrupting data. Availability: removal of critical directories can cause application failures. Impacted parties: local users, developers, and system administrators running vulnerable Python applications.

Remediation

Upgrade to filelock 4.2.1 or later. If upgrade is not immediately possible, ensure parent directories are sticky (chmod +t) and restrict rename/write permissions to trusted users. Monitor for unexpected directory deletions and audit filelock usage in critical environments.

Risk context

Medium severity CVSS 6.1. No EPSS data is available. The risk is moderate for environments where local users have write access to the parent directories of filelock lock files.

Affected products

• Python filelock