Description

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-05T22:17:46.693Z",
  "pubdate": "2026-11-05T22:17:46.693Z",
  "executiveSummary": "A local privilege escalation vulnerability exists in the filelock library, specifically within the StrictSoftFileLock and AsyncStrictSoftFileLock components on POSIX-compliant systems. The vulnerability stems from improper directory permission assignment during the creation of coordination and claim directories.\nBy failing to enforce restrictive modes during directory instantiation, the library relies on the system-wide umask or inherited ACLs, which may default to insecure, world-writable settings. This allows local attackers to manipulate the lock mechanism by deleting legitimate claim files or planting malicious ones.\nSuccessful exploitation permits an attacker to perform a race condition attack, leading to mutual exclusion failure. This allows unauthorized processes to acquire a lock while the legitimate process is still executing within the protected critical section. The vulnerability is present in versions 3.30.0 through 4.2.0 and is resolved in version 4.2.1.",
  "technicalDetails": "The vulnerability resides in the implementation of the lock coordination mechanism used by StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems. When these classes initialize, they create coordination and claim directories in the filesystem to track lock status. The root cause is the failure to explicitly define restrictive file system permissions (e.g., using mode 0700) during the os.mkdir or equivalent directory creation calls.\nBecause the library does not explicitly set the mode, the resulting directory permissions are dictated by the process's umask. If the environment umask is permissive (e.g., 0022), the coordination directory becomes writable by other users on the local system. This creates a security-sensitive state where the integrity of the locking mechanism is no longer guaranteed by the application logic, but rather by the host's environmental security configuration.\nThe exploitation flow proceeds as follows: 1) A victim process initializes a StrictSoftFileLock, creating a directory with overly permissive permissions. 2) An unprivileged local attacker monitors the filesystem for the creation of these coordination directories. 3) Upon detection, the attacker utilizes the write access to the directory to delete the active holder's claim files. 4) The attacker then creates their own malformed or spoofed claim file within the directory. 5) By removing the legitimate holder's claim, the attacker effectively breaks the mutual exclusion contract. 6) The lock-holding process continues execution in its critical section, while the attacker—or another malicious process—successfully acquires the lock via the spoofed claim.\nThis race condition forces a collision in the critical section, potentially leading to data corruption or unauthorized state changes if the lock was protecting shared resources. Furthermore, by planting malformed claims, an attacker can cause a Denial of Service (DoS) by preventing legitimate processes from acquiring the lock, as the initialization logic may fail or hang when encountering unexpected file artifacts in the coordination directory. This vulnerability requires local access to the system but does not require additional privileges beyond those of a standard local user."
}