Race Condition Enabling Link Following Affecting filelock package, versions [3.30.0,4.2.1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-FILELOCK-21802520
- published29 Oct 2026
- disclosed28 Oct 2026
- creditAnthropic's OSS Scanner
Introduced: 28 Oct 2026
NewCVE-2026-112938 (opens in a new tab)How to fix?
Upgrade filelock to version 4.2.1 or higher.
Overview
Affected versions of this package are vulnerable to Race Condition Enabling Link Following via the strict lock's claim directory creation in _strict.py, where the directory used to hold lock claims is not kept private to the lock owner. An attacker with write access to the parent directory can atomically swap the lock's coordination directory with a symlink pointing to a directory they cannot otherwise write, causing the victim process to create claim subdirectories inside that target directory between the ownership check and the actual use of the path. This allows an unprivileged local attacker to redirect file creation into directories owned by the victim user.
Note: This is only exploitable in a shared directory without the sticky bit set, where another local user has write access to the directory containing the lock file.