--- id: "CVE-2026-112908" kind: "vulnerability" aliases: ["CVE-2026-112908", "GHSA-6627-m3xw-93mp"] title: "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold" severity: "medium" cvss: 5.3 epss: null exploited: false status: "open" category: "package" products: [{"name": "filelock", "fixed": ["4.2.1"], "affected": ">= 3.30.0, <= 4.2.0", "ecosystem": "pypi"}] ecosystems: ["pypi"] tags: ["cwe-732", "filelock", "multi-user-linux", "package", "python", "shared-hosts"] not_affected_if: ["default-config", "not-using-strict-soft-filelock", "single-user-host", "umask-022-no-default-acl"] published_at: "2026-10-28T21:09:04+00:00" first_seen_at: "2026-10-28T21:12:45+00:00" updated_at: "2026-10-28T21:13:42+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6627-m3xw-93mp", "first_seen_at": "2026-10-28T21:12:45+00:00"}] --- # filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold StrictSoftFileLock creates its claim directories with a bare mkdir, so their permissions follow the umask or a default ACL rather than the requested mode. Another local user with write access to those directories can delete the holder's claim files, letting a second process enter the same critical section while the first still reports it holds the lock. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - pypi:filelock affected >= 3.30.0, <= 4.2.0 fixed 4.2.1 ## How to check - Run `pip show filelock` and confirm the version is between `3.30.0` and `4.2.0`. - Look for lock directories with `ls -ld .filelock .filelock/claims` and check for group or other write bits (for example `0777` or `2775`). - Run `getfacl -d ` on the lock's parent to see whether a default ACL grants group or other write access. ## Fix - Upgrade the Python package `filelock` to `4.2.1`. - Remove or `chmod` any existing `.filelock` directory tree created by an affected release, since upgrading does not change their mode. - Until upgraded, avoid permissive umasks or default ACLs on lock parent directories when using StrictSoftFileLock with a restrictive mode. ## Timeline - 2026-10-28T21:12:45+00:00 ghsa https://github.com/advisories/GHSA-6627-m3xw-93mp ## From the sources `StrictSoftFileLock` and `AsyncStrictSoftFileLock` apply the caller's `mode` to the sentinel (the lock file at ``) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, `.filelock` and `.filelock/claims`, with a bare `mkdir()`. That gives `0o777` filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default ACL (an access control list on a directory that sets the permissions of entries created inside it), through that ACL. A hold consists of two claim names in that directory, which has no sticky bit (a directory flag that lets only a file's owner remove it). When the environment leaves another local user (the other user below) a write bit on the directory, that user can unlink the holder's `0600` claims. Three settings do this: umask `000` in a sticky directory such as `/tmp`, umask `002` with the other user in the directory's group, or a default ACL on the lock's parent that grants the group write (the kernel then ignores the umask). After the unlink, the next contender of the holder's account finds the directory empty and enters. The first holder keeps reporting `is_locked == True` and later releases with no error. Affected versions: filelock >= 3.30.0 and <= 4.2.0 (finding `ANT-2026-AD6SUOON`). ## Severity **CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, 5.3 (Medium).** `AV:L` (local): the other user needs an account on the same host. `AC:H` (high attack complexity): the holder must pass a restrictive `mode` while its umask or the parent's default ACL leaves the other user a write bit on new directories, and a contender of the holder's account must ask for the lock after the claims are gone. With the common umask `022` and no default ACL the directories are `0755`, and the kernel refuses the other user's unlink. `PR:L` (low privileges): an unprivileged account is enough. `UI:N` (no user interaction): the holder's processes act on their own. `C:N` (no confidentiality impact): the `0600` claim files stay unreadable. `I:H` (high integrity impact): two holders then write the data the lock protects, and neither learns of the other. `A:L` (low availability impact): the same write access lets the other user create names in `claims`, and an empty file named `held-v1-<32 zeros>.claim` makes the next `acquire()` raise `SoftFileLockProtocolError` ("malformed claim record") until someone removes it. Classification from the review: security, conditional on a lax umask or a permissive default ACL. The scanner rated it high (CWE-732). ## Scope and preconditions - The holder passes a restrictive `mode` such as `0o600`. Without one, the umask decides the permissions by documented design (the "File permissions and mode" section of `docs/concepts.rst` defines `mode` only for the lock file). Umask `000` with the default mode gives the same two-holder result but is outside this finding. - The holder's environment leaves the other user a write bit on new directories. The scanner measured three ways, with `mode=0o600` and the other user a member of group `team`: | lock's parent directory | holder's umask | `.filelock` and `claims/` | who can unlink the claims | |---|---|---|---| | `1777`, like `/tmp` | `000` | `0777` | any other local user | | `root:team`, `3775` (setgid, so new entries inherit the group, and sticky) | `002` | `2775` | any member of `team` | | `root:team`, `1770`, default ACL `group:team:rwx` (`setfacl -d -m g:team:rwx`) | `077` | `0770` | any member of `team` | | `root:team`, `3775`, no ACL | `022` | `2755` | no one; the second process times out | The default-ACL row is the strongest. A holder with a private umask and `mode=0o600` still gets group-writable claim directories. The lock file in that row is `0600`, because its mode reaches `os.open` and masks the inherited ACL. - A contender that may enter asks for the lock: another process of the holder's account, or root. Nothing needs planting beforehand. The holder creates and owns the whole tree, so the existing-directory branch of `_ensure_protocol_directory` (the subject of GHSA-9c4x-gm8v-wgc4) plays no part. - Directories that an affected release already created keep their mode. A `0777` `.filelock` from an earlier run stays writable by other users after an upgrade, because filelock does not remove these directories. Upgraders should `chmod` or remove existing `.filelock` trees (see Workarounds). - The other lock classes do not have this gap in the same setting. With umask `000` and `mode=0o600`, `FileLock` and `SoftFileLock` create one `0600` file and nothing else, and `SoftReadWriteLock` creates its directories `0700` under any umask. Platform: POSIX permission semantics; demonstrated on Linux. filelock's checks against another local user hold only when no other user can replace the lock's directory or any of its ancestors. That is the case when each ancestor belongs to the lock's user or root and is either not writable by others or sticky. A user who can rename entries in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that. ## Affected code At the scanned commit b831496, the bare `mkdir()` sits in [`_ensure_protocol_directory`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L996-L998). [`StrictSoftFileLock._acquire`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L127-L133) calls it for both levels without a mode. It then passes `self._open_mode()` to the sentinel and, through [`_attempt_doorway`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L179-L181), to both claim files. The doorway (the acquire step that scans existing claims and publishes the caller's own) proceeds when the claim scan is empty. [`_unlink_owner_path_result`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L896-L900) counts a missing claim name as removed on release. ## Introduced The bare `mkdir()` arrived with the claim directories in 650c17c79c54 ("feat(strict): replace shared markers with owner claims", #659, 2026-07-14), first released in 3.30.0. We checked this against the git tags. Every release since 3.30.0 has it. ## Mechanism A process with umask `000` that takes `StrictSoftFileLock("/tmp//x.lock", mode=0o600)` leaves this on disk while it holds the lock, every entry owned by the holder: ``` 0600 x.lock 0777 x.lock.filelock 0777 x.lock.filelock/claims 0600 x.lock.filelock/claims/held-v1-.claim 0600 x.lock.filelock/claims/intent-v1-.claim ``` Removing a name needs write permission on the directory, and these directories are not sticky. Another local user who cannot read either claim can therefore unlink both. Renaming `claims/` away inside the `0777` `.filelock` has the same effect. For this lock class the directory permissions decide who can end a hold. The sentinel at `` is permanent and says nothing about who holds. A contender starts its doorway by listing the claim directory and proceeds when it is empty. Once the two names are gone, the next contender publishes its own intent and held claims and enters. The original holder does not notice. `is_locked` is its own counter, and `_release` removes its claims by name through `_unlink_owner_path_result`, which takes `FileNotFoundError` as "already removed". The first process therefore releases with exit status 0. No `force_break()`, lifetime or legacy client takes part. The other user's action is a plain `unlink`. The right to do it comes from filelock's `mkdir`, not from anything the application asked for. In the same setting the other user can neither read nor remove the `0600` sentinel in the sticky parent. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_