CVE-2026-112912: CWE-59: Improper Link Resolution Before File Access ('Link Following') in tox-dev filelock
Description
filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.
CVSS v3.1
Score 2.5low
Affected software
tox-dev
filelock
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-112912 in the tox-dev filelock package arises from improper link resolution (CWE-59) in the SoftFileLock implementation. Specifically, from versions 3.32.6 until 4.2.1, SoftFileLock performs a conditional os.access writability check on a node without its owner-write bit, during which it can follow a swapped symbolic link. This behavior allows a local user, under certain platform and directory configurations that follow symbolic links, to infer whether a specified path exists and is writable based on the observable result of the lock acquisition attempt. The vulnerability is limited to information disclosure about file system state and does not impact confidentiality, integrity, or availability beyond this. The issue is resolved in version 4.2.1.
Potential Impact
The impact is limited to local information disclosure, where a local user can infer the existence and writability of a file path by exploiting the symbolic link following behavior during the writability check. There is no impact on data integrity or availability, and no remote exploitation is indicated. The CVSS score of 2.5 reflects this low-severity information disclosure with low attack complexity and low privileges required.
Mitigation Recommendations
A fix is available in tox-dev filelock version 4.2.1. Users should upgrade to version 4.2.1 or later to remediate this vulnerability. No additional mitigation actions are specified or required beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-19T20:16:09.858Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad77f652cdf04f65637ac32
Added to database: 10/20/2026, 14:49:09 UTC
Last enriched: 10/20/2026, 15:03:41 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.