CVE-2026-112912
LOW
2,5
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.
59
Improper Link Resolution Before File Access ('Link Following')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Other
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Bypass Protection Mechanism
Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems:
Windows, Unix
https://github.com/tox-dev/filelock/security/advisories/GHSA-9j6q-wvj5-jgjg
https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae489353…
https://github.com/tox-dev/filelock/pull/835
https://github.com/tox-dev/filelock/releases/tag/4.2.1
https://github.com/tox-dev/filelock/security/advisories/GHSA-9j6q-wvj5-jgjg