MEDIUM 5.8 GitHub
CVE-2026-112938
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
`StrictSoftFileLock` and `AsyncStrictSoftFileLock` check `<path>.filelock` (the coordination directory that holds the lock's state) with one `lstat` call on its name. `lstat` reports what a name is without following a symbolic link (a file that redirects to another path). After that check, the code reaches `<path>.filelock/claims` by pathname for every later operation (`mkdir`, scan, publish, link, unlink). `_open_directory` passes `O_NOFOLLOW` (a flag that makes an open fail when the final name
Affected Products
- pip/filelock >= 3.30.0, <= 4.2.0
References
- https://github.com/advisories/GHSA-m462-7rxw-wvpg
- https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-28 via GitHub. Affected: pip/filelock >= 3.30.0, <= 4.2.0.
vulnfeed aggregates 17714 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.