ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-112936

filelock is a platform-independent file lock for Python.

Published Oct 20, 2026 · catalog updated Oct 28, 2026 · filelock is a platform-independent

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112936. EPSS is 0.23%. Act only if a listed version of filelock is a platform-independent is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (filelock is a platform-independent).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.23%
Remediation
Version ranges on file
Affected products
cpe tox-dev/filelock · pip filelock · pypi filelock

### Summary and resolve the lock path with and pass it to without refusing a symlink. A local user who can create names in the lock's directory, such as or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's own processes. ### Details stores , which follows a final symlink, and every connection opens that path through with no or regular-file check. SQLite's own VFS also resolves the final symlink in user space, so and the sticky bit do not help: the kernel never sees a symlink to refuse. The other lock classes do not follow a final symlink: opens with , and coordinates through . ### Proof of concept On Linux, with the victim and attacker as different users and mode 1777 with : 1. The attacker runs . 2. The victim constructs . A plain on the same path fails, but the lock creates , owned by the victim, inside a directory the attacker cannot write. 3. With , one victim process holds the write lock. The attacker repoints the link to , and a second victim process acquires the write lock while the first still holds it. The same behavior reproduces on macOS, on Windows 11, and through . ### Impact A local attacker with write access to the lock directory can make the victim create empty files it owns at paths the attacker cannot write, make the victim hold a SQLite lock on another application's database so that application gets , and give two victim processes the write lock at once, letting them corrupt the resource the lock protects. ### Workarounds Keep paths in directories that only trusted users can write.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe tox-dev/filelock< 4.0.9
  • pip filelock>= 3.20.4, <= 4.0.8
  • pypi filelockversion unspecified

How to fix CVE-2026-112936

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112936. EPSS is 0.23%. Act only if a listed version of filelock is a platform-independent is installed.

Which versions are affected?

Compare what you have installed with < 4.0.9, >= 3.20.4, <= 4.0.8. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-59: Link Following; CWE-668: Exposure of Resource to Wrong Sphere. EPSS 0.23%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · NIST NVD

    Detected

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed

  2. Oct 20, 2026 · NIST NVD

    Updated

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed

  3. Oct 20, 2026 · NIST NVD

    Updated

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed

  4. Oct 21, 2026 · NIST NVD

    Updated

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed

  5. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary and resolve the lock path with and pass it to without refusing a symlink. A local user who can create names in the lock's directory, such as or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's own processes. ### Details stores , which follows a final symlink, a

Sources

  • CVE.orgVulnerability recordCVE-2026-112936

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-112936

    30-day exploitation probability 0.23%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-j8f7-rjxc-mr56

    filelock: ReadWriteLock follows a symlink at the lock path into SQLite

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-112936

    ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve() and pass it to sqlite3.connect() without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's o

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-112936

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 1, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 29, 2026
  • FIRST EPSSOct 23, 2026
  • NIST NVDOct 21, 2026
  • CVE.orgOct 21, 2026