CVE-2026-112941

What it actually does

A local race condition in SoftReadWriteLock and AsyncSoftReadWriteLock allows caching of a successful .rw lock tree check followed by re-resolution of names during record operations, enabling redirection of lock-record writes into directories controlled by another local user.

Why it matters to the business

Applications relying on filelock for coordination may experience unauthorized local file modifications or data integrity issues, especially in multi-user environments or build tooling, with exploitation publicly available shortly after disclosure.

How an attack unfolds

A local attacker monitors for an initial successful lock acquisition by the victim process, replaces the cached lock tree with a malicious symlink or directory structure pointing to attacker-writable locations, then triggers subsequent record operations that follow the redirected paths and write lock data under the attacker's control.

How to fix it

Upgrade filelock to version 4.2.1 or later; rebuild and redeploy any affected packages or containers; verify no pinned vulnerable versions remain in dependency manifests.

How to confirm the fix worked

Confirm installed filelock version is 4.2.1 or higher via package manager or requirements files; re-run application lock operations under concurrent local user scenarios to ensure no redirection occurs; scan dependency trees for any pre-4.2.1 instances.

Typical attack path

1. Victim process performs first successful check of the .rw lock tree
2. Attacker replaces the lock tree with a controlled directory or symlink
3. Victim process resolves names again during later record operations
4. Lock writes are redirected into attacker-writable directories
5. Attacker observes or manipulates resulting files to achieve integrity impact

How to detect it

Examine application logs for unexpected file paths or permission errors during lock operations; review system audit logs for file creation or symlink changes in lock directories immediately after lock acquisitions; look for processes writing to non-standard locations under the context of the locking application.

What your security team should do

• Immediately upgrade all instances of filelock to 4.2.1 or newer across development and production environments
• Audit dependency graphs for downstream packages that bundle vulnerable filelock versions
• Add package version pinning and automated scanning to prevent reintroduction of affected releases
• Review local multi-user systems for processes using filelock and monitor for unexpected file writes