ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-112913

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

Published Oct 23, 2026 · catalog updated Oct 23, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 8, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112913. EPSS is 0.12%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Low3.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.12%
Remediation
Version ranges on file
Affected products
PyPI filelock · pip filelock · pypi filelock

On Windows, and (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: , the rollback journal (pages saved to undo an interrupted write); , the write-ahead log (changes kept outside the main file); and , the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone on it, which a file's creator may do. (the temporary directory of services, granting create but not delete) and are such directories. With a in place, every and of the user running the lock (below: the lock user) raises at once, whatever says, until that account removes its file; the lock user cannot. With a beside a lock database that holds a table, SQLite replays the journal and deletes the file the journal names, a file of the lock user, and the acquire reports success. Affected versions are filelock 3.20.4 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the POSIX form of the defect, GHSA-v4x8-3wr5-3wq8, whose text says "Windows does not take this path" (review round 4, finding F2 of set D). It is not among the findings of the report Anthropic's OSS Scanner sent on 15 October 2026. ## Severity **CVSS 3.1 scores 3.3 (Low).** (local): the other account needs a logon on the same host. (low attack complexity): create one file beside the database and set its ACL (access control list); no race, and the other account can place the file days earlier. (low privileges): an ordinary account that can create files in the directory is enough. (no user interaction). (scope unchanged). (no confidentiality impact): the other account learns nothing. (no integrity impact in the scored variant): see the scoring note. (partial availability

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI filelock3.20.4 → 4.2.1
  • pip filelock>= 3.20.4, <= 4.2.0
  • pypi filelock>=3.20.4,<4.2.1

How to fix CVE-2026-112913

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112913. EPSS is 0.12%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with 3.20.4 → 4.2.1, >= 3.20.4, <= 4.2.0, >=3.20.4,<4.2.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-412. EPSS 0.12%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Windows security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    On Windows, and (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: , the rollback journal (pages saved to undo an interrupted write); , the write-ahead log (changes kept outside the main file); and , the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the datab

  2. Oct 23, 2026 · GitHub Advisory Database

    Updated

    On Windows, and (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: , the rollback journal (pages saved to undo an interrupted write); , the write-ahead log (changes kept outside the main file); and , the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the datab

  3. Oct 23, 2026 · PyPA Advisory Database

    Fix available

    filelock fixed in 4.2.1

  4. Oct 23, 2026 · PyPA Advisory Database

    Fix available

    filelock fixed in 4.2.1

  5. Oct 23, 2026 · PyPA Advisory Database

    Updated

    On Windows, and (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: , the rollback journal (pages saved to undo an interrupted write); , the write-ahead log (changes kept outside the main file); and , the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the datab

Sources

  • CVE.orgVulnerability recordCVE-2026-112913

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-112913

    30-day exploitation probability 0.12%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-9vhv-jxww-xfm5

    filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-112913

    On Windows, ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal (pages saved to undo an interrupted write); -wal, the write-ahead log (changes kept outside the main file); and -shm, the shared-memory index of the WAL. SQLite act

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorypypi/filelock/CVE-2026-112913.yml

    On Windows, and (the SQLite-backed + reader/writer lock) connect SQLite to the lock database by its path, in every directory. + SQLite derives three side files from that path: , the rollback + journal (pages saved to undo an interrupted write); , the write-ahead + log (changes kept outside the main file); and , the shared-memory + index of the WAL. SQLite acts on whichever of these it finds beside

    gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-9vhv-jxww-xfm5

    filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

    osv.dev
  • Red Hat Security DataVendor advisoryCVE-2026-112913

    filelock: filelock: Denial of service via pre-created SQLite side files

    access.redhat.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Red Hat Security DataNov 8, 2026
  • FIRST EPSSNov 6, 2026
  • GitLab Advisory DatabaseOct 27, 2026
  • GitLab Advisory DatabaseOct 26, 2026
  • PyPA Advisory DatabaseOct 25, 2026
  • CVE.orgOct 24, 2026
  • GitHub Advisory DatabaseOct 24, 2026