Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-112909

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

Description

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

tox-dev filelock

  • < 4.2.1affected

References