CVE-2026-112937: Arbitrary Directory Deletion via TOCTOU Race Condition in filelock ReadWriteLock

Vulnerability ID: CVE-2026-112937
CVSS Score: 6.1
Published: 2026-10-23

A Time-of-Check Time-of-Use (TOCTOU) race condition in the Python filelock library (versions 4.1.0 to 4.2.0) allows local unprivileged attackers to cause arbitrary directory deletion by swapping file system targets during lock cleanup or dead owner sweeps.

TL;DR

Local unprivileged users can manipulate lock directories created by filelock's ReadWriteLock, causing victim processes to recursively delete arbitrary directories using path-based shutil.rmtree calls.

Technical Details

• CVE ID: CVE-2026-112937
• Weakness Class: CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition
• CVSS v3.1 Score: 6.1 (Medium)
• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Attack Vector: Local (Unprivileged)
• Exploit Maturity: None (No public weaponized exploit)
• CISA KEV Status: Not Listed

Affected Systems

• Python environments utilizing tox-dev filelock versions 4.1.0 through 4.2.0
• Systems deploying ReadWriteLock or AsyncReadWriteLock in shared parent directories
• filelock: >= 4.1.0, < 4.2.1 (Fixed in: 4.2.1)

Code Analysis

Commit: 5e3f2ec

Fix TOCTOU race condition in ReadWriteLock directory removal and enforce file descriptor identity verification

Mitigation Strategies

• Upgrade filelock library to version 4.2.1 or newer.
• Restrict parent directories containing lock files to 0o700 permissions owned by the process user.
• Avoid creating file locks in shared, non-sticky world-writable directories.

Remediation Steps:

1. Identify python environments using filelock versions >= 4.1.0 and < 4.2.1.
2. Execute pip install --upgrade filelock>=4.2.1 to install fixed version.
3. Verify lock file output paths are placed in secure user runtime directories such as $XDG_RUNTIME_DIR.

References

• GitHub Security Advisory GHSA-jqc4-5cvw-7w85
• Official Patch Commit 5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d
• GitHub Pull Request #834
• filelock Version 4.2.1 Release Notes
• NVD Vulnerability Detail - CVE-2026-112937
• CVE Record CVE-2026-112937

Read the full report for CVE-2026-112937 on our website for more details including interactive diagrams and full exploit analysis.