GHSA-CRV4-6MHJ-J5JH filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

EUVD-2026-105020

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112914 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112914 Source advisory: OSV:GHSA-CRV4-6MHJ-J5JH...

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

GHSA-V4X8-3WR5-3WQ8 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112940 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112940 Source advisory: OSV:GHSA-V4X8-3WR5-3WQ8...

EUVD-2026-105031

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112940 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112940 Source advisory: GHSA-V4X8-3WR5-3WQ8...

PT-2026-122459

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122418

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

PT-2026-122428

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122458

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

SUSE CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

SUSE CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

SUSE CVE-2026-112911

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol...

SUSE CVE-2026-112912

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that...

SUSE CVE-2026-112914

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link...

SUSE CVE-2026-112915

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

SUSE CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

SUSE CVE-2026-112935

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...