CVE-2026-112911

Affected versions of the `filelock` package are vulnerable to Unverified Ownership due to adopting an existing protocol directory without checking which user created it. The `StrictSoftFileLock` class from 3.30.0 and the `SoftReadWriteLock` class from 4.0.0 reuse a protocol directory in a shared parent directory even when another local user created it first. A local attacker who creates that directory before the victim can alter the protocol state and admit concurrent lock holders, which breaks the mutual exclusion the lock is meant to guarantee.