CVE-2026-112937: tox-dev filelock

CVSS: 6.1v3.1MediumReceived

Published 20-10-2026Last modified 20-10-2026

Open JSON

Vulnerability summary

CVE-2026-112937 is a medium (CVSS 6.1) vulnerability in tox-dev filelock.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

20-10-2026
PublishedVulnerability first disclosed.

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

CVSS metrics

2 scores · 2 sources · 1 version

v3.16.1

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected systems

Tox-dev1 product

filelock≥ 4.1.0, < 4.2.1

1 vendor · 1 product

References

4 links

github.com/tox-dev/filelock/security/advisories/GHSA-jqc4-5cvw-7w85X Refsource CONFIRM
github.com/tox-dev/filelock/pull/834X Refsource MISC
github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2dX Refsource MISC
github.com/tox-dev/filelock/releases/tag/4.2.1X Refsource MISC