CVE-2026-112938

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112938", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-19T21:30:47.245Z", "datePublished": "2026-11-05T21:51:04.350Z", "dateUpdated": "2026-11-09T17:41:37.261Z"}, "containers": {"cna": {"title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses", "problemTypes": [{"descriptions": [{"cweId": "CWE-363", "lang": "en", "description": "CWE-363: Race Condition Enabling Link Following", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg"}, {"name": "https://github.com/tox-dev/filelock/pull/839", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/pull/839"}, {"name": "https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b"}, {"name": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}, {"name": "https://github.com/tox-dev/filelock/releases/tag/4.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1"}], "affected": [{"vendor": "tox-dev", "product": "filelock", "versions": [{"version": ">= 3.30.0, < 4.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T21:51:04.350Z"}, "descriptions": [{"lang": "en", "value": "filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1."}], "source": {"advisory": "GHSA-m462-7rxw-wvpg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:36:05.028237Z", "id": "CVE-2026-112938", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:41:37.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112938", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:36:05.028237Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:36:06.364Z"}}], "cna": {"title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses", "source": {"advisory": "GHSA-m462-7rxw-wvpg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tox-dev", "product": "filelock", "versions": [{"status": "affected", "version": ">= 3.30.0, < 4.2.1"}]}], "references": [{"url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg", "name": "https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tox-dev/filelock/pull/839", "name": "https://github.com/tox-dev/filelock/pull/839", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b", "name": "https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03", "name": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1", "name": "https://github.com/tox-dev/filelock/releases/tag/4.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-363", "description": "CWE-363: Race Condition Enabling Link Following"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T21:51:04.350Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112938", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:41:37.261Z", "dateReserved": "2026-10-19T21:30:47.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T21:51:04.350Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "filelock", "vendor": "tox-dev", "versions": [{"status": "affected", "version": ">= 3.30.0, < 4.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1."}], "id": "CVE-2026-112938", "lastModified": "2026-11-09T18:17:20.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112938", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:36:05.028237Z", "version": "2.0.3"}}]}, "published": "2026-11-05T22:17:47.213", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/pull/839"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-363"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "filelock: filelock: Denial of Service (DoS) via symbolic link race condition", "id": "2567732", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567732"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in filelock. A local attacker with write access to a shared directory can exploit a timing race condition to substitute a lock directory with a symbolic link. This flaw primarily allows an attacker to cause a Denial of Service (DoS) by stranding lock files in other lock locations, causing legitimate processes to time out when attempting to acquire locks. Additionally, this issue may lead to unauthorized file creation or minor information disclosure through error messages."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-112938", "public_date": "2026-11-05T21:51:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112938\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112938\nhttps://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b\nhttps://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03\nhttps://github.com/tox-dev/filelock/pull/839\nhttps://github.com/tox-dev/filelock/releases/tag/4.2.1\nhttps://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg"], "statement": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires an unprivileged local user to win a time-of-check to time-of-use race condition, and the impact is confined to lock contention, localized denial of service, or minimal information leakage rather than system compromise. In standard Red Hat enterprise deployments, automated services and workloads typically isolate lock targets within user-owned or restricted-access directories where untrusted accounts cannot alter intermediate filesystem components. Consequently, the issue only presents a practical risk on multi-user systems where applications are explicitly configured to place strict file locks inside shared or world-writable directory trees.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.30.0,4.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "filelock", "source": "cna", "vendor": "tox-dev"}, "product": "filelock", "vendor": "tox-dev"}], "created": "2026-11-05T23:30:16.308759+00:00", "updated": "2026-11-06T14:30:06.072372+00:00", "vendors": ["tox-dev", "tox-dev$PRODUCT$filelock"]}