CVE-2026-112937: Arbitrary Directory Deletion via TOCTOU Race Condition in filelock ReadWriteLock

Vulnerability ID: CVE-2026-112937

CVSS Score: 6.1

Published: 2026-10-23

A Time-of-Check Time-of-Use (TOCTOU) race condition in the Python filelock library (versions 4.1.0 to 4.2.0) allows local unprivileged attackers to cause arbitrary directory deletion by swapping file system targets during lock cleanup or dead owner sweeps.

TL;DR

Local unprivileged users can manipulate lock directories created by filelock's ReadWriteLock, causing victim processes to recursively delete arbitrary directories using path-based shutil.rmtree calls.

Technical Details

CVE ID : CVE-2026-112937

Weakness Class : CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition

CVSS v3.1 Score : 6.1 (Medium)

CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector : Local (Unprivileged)

Exploit Maturity : None (No public weaponized exploit)

CISA KEV Status : Not Listed

Affected Systems

Python environments…