---
id: CVE-2026-112909
title: >-
  filelock: UnixFileLock truncates and chmods any regular file another user
  renames or hard-links onto the lock path
summary: >-
  filelock is a platform-independent file lock for Python. Prior to 4.2.1,
  UnixFileLock can truncate a regular file renamed onto the lock path when
  another local user has actual rename permission, or hard-linked there under a
  permissive ha…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-706
vendor: tox-dev
product: filelock
affected:
  - filelock < 4.2.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T14:16:02.317Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112909'
references:
  - url: >-
      https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879
    label: >-
      https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879
  - url: 'https://github.com/tox-dev/filelock/pull/835'
    label: 'https://github.com/tox-dev/filelock/pull/835'
  - url: >-
      https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
    label: >-
      https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
  - url: 'https://github.com/tox-dev/filelock/releases/tag/4.2.1'
    label: 'https://github.com/tox-dev/filelock/releases/tag/4.2.1'
tags:
  - cve.org
ingestedAt: '2026-10-20T15:09:24.129Z'
---

## Overview

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.

## Affected

- `filelock < 4.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.