p PatchFirst

CVE-2026-112909

CVE-2026-112909 · filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

This page contains facts from public vulnerability sources. Check the original advisory before updating.

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.

CVSS 6.1 · Medium · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • filelock

    Versions
    • < 4.2.1: Affected

    No fix published

  • python-filelock Debian:12

    Versions
    • 3.12.2-1
    • 3.12.3-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.3-1
    • 3.13.4-1
    • 3.14.0-1
    • 3.15.4-1
    • 3.16.1-1
    • 3.16.1-2
    • 3.17.0-1
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 3.9.0-1
    • 3.9.0-1+deb12u1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:13

    Versions
    • 3.18.0-1
    • 3.18.0-1+deb13u1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:14

    Versions
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.11-1
    • 2.0.12-1
    • 2.0.13-1
    • 3.0.0-2
    • 3.0.3-1
    • 3.0.4-1
    • 3.0.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.12-1
    • 3.0.12-2
    • 3.0.12-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.12-2
    • 3.3.2-1
    • 3.4.0-1
    • 3.4.2-1
    • 3.4.2-2
    • 3.6.0-1
    • 3.6.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:24.04:LTS

    Versions
    • 3.12.2-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.10

    Versions
    • 3.20.3-1
    • 3.29.4-1
    • 3.32.0-1
    • 3.32.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.04:LTS

    Versions
    • 3.18.0-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →