CVE-2026-112914
EUVD-2026-10502020.10.2026, 15:17
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| tox-dev | filelock | 4.1.0 ≤ 𝑥 < 4.2.1 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
- CWE-363 - Race Condition Enabling Link FollowingThe software checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the software to access the wrong file.
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.