CVE-2026-112935

What it actually does

SoftFileLock in filelock 3.22.0-4.2.0 permits a race where an attacker can delete its own stale lock marker after the honest process has read it but before it can validate the successor marker's timestamp, allowing two processes to hold the lock simultaneously on the same inode.

Why it matters to the business

Applications relying on file-based locking for exclusive access may experience data corruption or inconsistent state when multiple processes write to the same resource at once, increasing operational risk for any Python software using the library until upgraded.

How an attack unfolds

An attacker with local access observes or forces creation of a stale lock file, releases their marker after the victim reads it, then races to create a new lock whose mtime is not strictly newer than the victim's saved observation, tricking the victim into removing the live lock and allowing concurrent access.

How to fix it

Upgrade filelock to version 4.2.1 or later for all affected installations; until then, switch to the platform-native FileLock implementation or add external synchronization.

How to confirm the fix worked

Confirm filelock >= 4.2.1 is installed via pip show or package metadata; run the library's regression tests for SoftFileLock under concurrent load; monitor for duplicate lock acquisitions in application logs.

Typical attack path

1. Identify Python process using filelock SoftFileLock on a shared path
2. Create or wait for a stale lock marker on the target inode
3. Release attacker marker after victim reads the stale state
4. Immediately acquire a new lock whose mtime satisfies the victim's timestamp check
5. Trigger the victim to delete the new lock marker, resulting in dual holders

How to detect it

Review application and system logs for concurrent write attempts or lock-acquisition failures around the affected library; look for processes holding duplicate file locks on the same path via lsof or equivalent tooling.

What your security team should do

• Immediately inventory all Python environments for filelock versions < 4.2.1
• Prioritize upgrade to 4.2.1 in high-concurrency or data-integrity sensitive workloads
• Temporarily replace SoftFileLock usage with FileLock or external locking primitives
• Add dependency pinning and automated scanning to prevent regression