CVE-2026-112937

What it actually does

Race condition in ReadWriteLock cleanup from version 4.1.0 to 4.2.1 allows removal of a randomized .filelock-* private hard-link directory, enabling observation or forgery of names for sibling directory rename and deletion by another local user with rename access in a non-sticky parent directory.

Why it matters to the business

Local attackers can delete or interfere with files and directories owned by other users on the same system, leading to data loss, service disruption, or integrity violations in shared environments using the library.

How an attack unfolds

An attacker with local rename access monitors the .filelock-* cleanup process, observes or forges a dead-owner sweep name, and renames a sibling directory onto it to force deletion; exploit code is publicly available and the flaw was published six days ago.

How to fix it

Upgrade tox-dev filelock to version 4.2.1 or later on all affected systems; verify the installed version after update and restart dependent Python processes.

How to confirm the fix worked

Run 'python -c "import filelock; print(filelock.__version__)"' to confirm version 4.2.1 or higher; review application dependency manifests and test lock/unlock operations under concurrent local users.

Typical attack path

1. Identify a process using filelock ReadWriteLock on a shared non-sticky parent directory
2. Wait for or trigger cleanup of the randomized .filelock-* hard-link directory
3. Observe live name or forge dead-owner sweep name during the race window
4. Rename attacker-controlled sibling directory onto the target name
5. Trigger deletion of the renamed directory to remove victim data

How to detect it

Review system logs and file access events for unexpected renames or deletions involving .filelock-* directories; examine Python process activity and audit trails around lock cleanup operations for race-condition timing anomalies.

• .filelock-
• ReadWriteLock
• private-hard-link directory

What your security team should do

• Immediately upgrade all instances of filelock to 4.2.1
• Scan for and replace any pinned versions between 4.1.0 and 4.2.0 in requirements or lockfiles
• Monitor local user activity on shared directories used by filelock
• Prioritize systems with high EPSS and public exploit availability