Skip to content
OpenAdvisories
Low · 2.5 CVE-2026-112912 EUVD-2026-105019GHSA-9j6q-wvj5-jgjg

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

Published Oct 20, 2026 · Updated Oct 20, 2026 · Assigned by GitHub_M

Description

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.

Affected products

VendorProductAffectedFixed
tox-dev filelock >= 3.32.6, < 4.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-filelock 4.2.8-1 —
Debian 13 python-filelock No fix yet —
Debian 12 python-filelock No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-filelock No fix yet —
Ubuntu 26.04 LTS python-filelock No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS python-filelock No fix yet —
Ubuntu Pro 22.04 LTS python-filelock No fix yet —
Ubuntu Pro 20.04 LTS python-filelock No fix yet —
Ubuntu Pro 18.04 LTS python-filelock No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling py3.10-filelock No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI filelock >= 3.32.6, < 4.2.1 4.2.1 GHSA-9j6q-wvj5-jgjg

References