CVE-2026-112934: filelock — Exploit & Fix

Description

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

Is your site exposed to CVE-2026-112934?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS — Exploit Prediction

0.0023

Probability of exploitation

0.14%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-62 CWE-62

Affected Products

Vendor	Product	Versions
tox-dev	filelock	4.0.0 — 4.2.1

References

Advisories & Patches

https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03 https://github.com/tox-dev/filelock/pull/842 https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845 https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845

Exploits

https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845 https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845

Other References

https://github.com/tox-dev/filelock/releases/tag/4.2.1

Frequently Asked Questions

What is CVE-2026-112934? +

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1. It has a CVSS v3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2026-112934? +

CVE-2026-112934 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0023, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-112934? +

CVE-2026-112934 affects products from tox-dev, specifically: filelock. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-112934? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-36486 7.8

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). …

CVE-2024-54189 7.8

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a …

CVE-2026-112940 7.1

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side …

CVE-2025-68146 6.3

filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local …

CVE-2026-112911 6.3

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from …

CVE-2026-112936 6.1

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the …

CVE-2026-112934