CVE-2026-112911

mediumpriority · track · 0EPSS 0.001 · 4 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 6.3 · medium

Is it mine?

1 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.

cvss

Technical severity, 0–10. One row per scoring source.

6.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.3mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondary · security-advisories@github.comexploitability 1 · impact 5.2

v3.15.8mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-283USprimary

affected products (1)

Products and version ranges known to be affected.

tox-dev filelock3.30.0 → 4.2.1nvdUScpe:2.3:a:tox-dev:filelock:*:*:*:*:*:*:*:*

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-10-20modified 2026-10-21

related (36)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-27903US	critical9.8	8.92% (95th)	—	2024-07-08
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact w…
CVE-2019-9010US	critical9.8	1.90% (80th)	—	2019-08-15
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODES…
CVE-2020-8554US	medium5.0	8.72% (95th)	Exploit	2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Addit…
CVE-2026-26016US	high8.1	0.36% (30th)	—	2026-02-19
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers…
CVE-2021-24501US	high8.1OT elevated	1.25% (69th)	—	2021-08-09
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifyin…

+31 more

references (4) nvd

External citations — patches, advisories, analysis.

https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03Patch
https://github.com/tox-dev/filelock/pull/839Patch
https://github.com/tox-dev/filelock/releases/tag/4.2.1Release Notes
https://github.com/tox-dev/filelock/security/advisories/GHSA-9c4x-gm8v-wgc4ExploitMitigationPatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan