Vulnerabilities

Vulnerability · CVE-2026-112938

filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · filelock: StrictSoftFileLock follows a

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-112938. A missing EPSS score is not a low risk. Compare filelock: StrictSoftFileLock follows a with the linked advisory before you change production.

Severity

Medium5.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Not in the current FIRST EPSS dataset

Remediation

Version ranges on file

Affected products

pip filelock · pypi filelock

and check (the coordination directory that holds the lock's state) with one call on its name. reports what a name is without following a symbolic link (a file that redirects to another path). After that check, the code reaches by pathname for every later operation ( , scan, publish, link, unlink). passes (a flag that makes an open fail when the final name is a symbolic link), but the flag covers only the final component. The kernel follows a symbolic link in any earlier component. Another local user (the other user below) who can rename exchanges it for a symbolic link after the check. In a shared directory without the sticky bit (a directory flag that lets only a file's owner rename or remove it), any user with write access can do this. Where the shared directory is sticky, such as , only the user who created before the user running the lock (the lock user below) first used it can. The lock user's process (root's, if root takes the lock) then creates a directory and claim files (the files whose presence says a process wants or holds the lock) inside a directory the other user chooses but only the lock user can write. When the link points at another strict lock's directory, the stranded claims make that lock time out for every process until an operator finds and force-breaks each one. The property and resolve the same path with no check at all. Affected versions: filelock >= 3.30.0 and <= 4.2.0 (finding ). ## Severity **CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8 (Medium).** (local): the other user needs an account on the same host. (high attack complexity): the swap must land between the and the next . The other user does not aim at that window. It flips the name in a loop with (a system call that swaps two names in one step) across repeated acquires, and won after 1 to 31 runs of the lock user's program in the scanner's trials. A sticky directory also requires it to have created first. (low privileges): an unprivileged account is enough. (no user interaction