cve.bz

CVE-2026-112913

3.3 lowEPSS 0.1%Fix available

Low (3.3) in tox-dev filelock. EPSS 0.1% estimated probability of exploitation activity in the next 30 days. Fixed in filelock 4.2.1.

On this page
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use _connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to place a database-wal or database-journal side file before acquisition. An undeletable WAL file makes each read or write acquisition fail immediately with sqlite3.OperationalError regardless of timeout. Separately, when the database contains at least one table, a hot journal that grants the lock account modify rights can cause SQLite recovery to delete a file named by that journal only when the lock account has permission to delete the target. The issue requires a directory writable by another account, such as a shared Windows temporary directory, and does not affect private directories. This issue is fixed in version 4.2.1.

Severity

CVSS 3.1

3.3 low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS
0.1% estimated probability of exploitation activity in the next 30 days; 2nd percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC)
Exploitation: PoC · Automatable: no · Technical impact: partial, assessed 2026-11-06. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Published
Modified
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-112913 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-112913?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-112913?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-112913 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
tox-dev filelock>= 3.20.4, < 4.2.1

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9vhv-jxww-xfm5PyPIfilelock>=3.20.4 <4.2.14.2.1

Linux distributions

DistributionReleasePackageFixed inAdvisory
Ubuntu26.04:LTS, 26.10, Pro:18.04:LTS and 3 morepython-filelockno fix listedUBUNTU-CVE-2026-112913

From the distributions' data via OSV.dev: Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Ubuntu.

Red Hat

Red Hat rates this Low.

Red Hat's statement

This vulnerability is rated as Low severity because it requires local access on Windows environments, which are not typical deployment targets for Red Hat products. The flaw occurs when shared directories allow unprivileged local accounts to pre-create auxiliary database files, disrupting lock acquisition or triggering targeted file deletion during recovery. Because Red Hat platforms operate on Linux architectures where filelock uses POSIX locking mechanisms rather than the vulnerable Windows code path, standard enterprise deployments are not exposed to this behavior.

Red Hat's mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ProductPackageStateAdvisory
Red Hat OpenShift AI (RHOAI)rhoai/odh-mlflow-rhel9Fix deferred

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-112913.

Attack patterns (CAPEC)

  • CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
  • CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON