MEDIUM 5.3 GitHub
CVE-2026-112908
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
`StrictSoftFileLock` and `AsyncStrictSoftFileLock` apply the caller's `mode` to the sentinel (the lock file at `<path>`) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, `<path>.filelock` and `<path>.filelock/claims`, with a bare `mkdir()`. That gives `0o777` filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default AC
Affected Products
- pip/filelock >= 3.30.0, <= 4.2.0
References
- https://github.com/advisories/GHSA-6627-m3xw-93mp
- https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-28 via GitHub. Affected: pip/filelock >= 3.30.0, <= 4.2.0.
vulnfeed aggregates 17714 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.