CVE-2026-112912

Affected versions of the `filelock` package are vulnerable to Link Following due to a writability check that follows a symbolic link swapped in by another user. `SoftFileLock` calls `os.access` to check whether a lock node without its owner write bit is writable, and that conditional check resolves a symbolic link that another local user can swap in at the lock path. On a platform and directory configuration that follows the link, a local attacker can read the observable acquisition result to infer whether a chosen path exists and is writable by the lock user, disclosing file system information.