{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112908", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-19T20:16:09.857Z", "datePublished": "2026-11-05T21:54:53.585Z", "dateUpdated": "2026-11-05T21:54:53.585Z"}, "containers": {"cna": {"title": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "lang": "en", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp"}, {"name": "https://github.com/tox-dev/filelock/pull/839", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/pull/839"}, {"name": "https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde"}, {"name": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}, {"name": "https://github.com/tox-dev/filelock/releases/tag/4.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1"}], "affected": [{"vendor": "tox-dev", "product": "filelock", "versions": [{"version": ">= 3.30.0, < 4.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T21:54:53.585Z"}, "descriptions": [{"lang": "en", "value": "filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, \u00a0StrictSoftFileLock\u00a0 and \u00a0AsyncStrictSoftFileLock\u00a0 on POSIX systems create coordination and claim directories without applying the caller\u2019s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder\u2019s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1."}], "source": {"advisory": "GHSA-6627-m3xw-93mp", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "filelock", "vendor": "tox-dev", "versions": [{"status": "affected", "version": ">= 3.30.0, < 4.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, \u00a0StrictSoftFileLock\u00a0 and \u00a0AsyncStrictSoftFileLock\u00a0 on POSIX systems create coordination and claim directories without applying the caller\u2019s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder\u2019s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1."}], "id": "CVE-2026-112908", "lastModified": "2026-11-05T22:17:46.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-05T22:17:46.693", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/pull/839"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{}