CVE-2026-112941

Affected versions of the `filelock` package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition due to caching a successful check of the lock tree and resolving its names again later. `SoftReadWriteLock` and `AsyncSoftReadWriteLock` validate the `<path>.rw` lock tree once and then resolve its names again during later record operations without repeating the check. A local attacker who can replace that tree after the first acquisition can redirect lock record writes into any directory the lock user can write to.