CVE-2026-112936

A flaw was found in filelock. The ReadWriteLock component does not properly reject symbolic links shortcuts pointing to another file path when resolving lock paths. A local user with write permissions in the lock directory can exploit this vulnerability to redirect lock file creation and database...

CVE-2026-112941

A flaw was found in filelock. The SoftReadWriteLock and AsyncSoftReadWriteLock mechanisms cache an initial directory check but resolve path names again during subsequent record operations. A local attacker can exploit this behavior by replacing the lock directory structure after its initial...

CVE-2026-112912

A flaw was found in filelock. When SoftFileLock verifies file permissions during lock acquisition, it may follow an untrusted symbolic link. A local attacker could exploit this behavior in shared directories to infer whether a target file path exists and is writable, resulting in unauthorized...

CVE-2026-112939

A flaw was found in filelock. The SoftFileLock component can trust a forged process identifier PID in a lock marker file that an attacker can modify. A local attacker can exploit this flaw to cause an authorized process to act as a confused deputy, improperly removing an active lock marker and...

CVE-2026-112906

A flaw was found in filelock. A local attacker can manipulate lock file timestamps when multiple processes are waiting for a lock, causing the SoftFileLock component to misidentify an active lock as expired. As a result, legitimate lock files can be prematurely removed, allowing unauthorized...

CVE-2026-112935

A flaw was found in filelock. A local attacker can exploit a race condition in the SoftFileLock mechanism during stale lock cleanup. Under specific timing and file system conditions involving reused file nodes, filelock may mistakenly delete an active lock marker held by another process. This...

CVE-2026-112914

A flaw was found in filelock. A local attacker with write access to a shared lock directory can exploit the SoftFileLock mechanism to cause unauthorized file exposure. When filelock restores a stale lock marker by name, the attacker can swap in a symbolic link, causing the victim's process to...

CVE-2026-112934

A flaw was found in filelock. A local user with rename permissions in the lock directory can cause a Denial of Service DoS by replacing lock holder records with a named pipe, causing locking operations to stall indefinitely. Under permissive file system policies, an attacker can also link target...

CVE-2026-112909

A flaw was found in filelock. A local attacker can exploit this vulnerability by placing a target regular file at the expected lock file path using a file rename or hard link. When filelock acquires the lock, it can unintentionally truncate the contents of the target file and alter its permission...

CVE-2026-112911

A flaw was found in filelock. This vulnerability allows a local attacker to manipulate lock state by pre-creating a protocol directory within a shared parent directory. When filelock adopts this untrusted directory, the attacker can alter the protocol state and admit unauthorized concurrent lock...

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the lock-file open logic in unix.py and related backends, where acquiring a lock on a file that does not yet exist creates it with a permissive mode e.g. 0o666 rather than preserving the...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112909 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112909 Source advisory: SNYK:PYTHON-FILELOCK-21280759...

UNIX Hard Link

Overview Affected versions of this package are vulnerable to UNIX Hard Link via OsFiles.overwrite in SoftReadWriteLock, which refreshes holder records by name without verifying the file identity. A local attacker who has rename access to the lock directory can replace a holder record with a named...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112934 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112934 Source advisory: SNYK:PYTHON-FILELOCK-21280758...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5859 more potentially affected by CVE-2026-112912 via filelock (>=3.32.6, <=4.2.0)

filelock PYPI version =3.32.6, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112912 Source advisory: SNYK:PYTHON-FILELOCK-21280761...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the lock file open logic in api.py and related platform backends, where an existing lock file's permissions are not preserved on Unix systems. An attacker with local access can observe the file mode applied to a newly...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112914 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112914 Source advisory: SNYK:PYTHON-FILELOCK-21280757...

Unverified Ownership

Overview Affected versions of this package are vulnerable to Unverified Ownership via the strict lock implementation in strict.py and related claim directory handling, where mkdirmode=0o700 only enforces private permissions when it creates the directory and the subsequent lstat check reads neithe...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via SoftFileLock.trybreakstalelock in src/filelock/soft.py, which can restore a stale marker by name after moving it aside. A local attacker with rename access in a non-sticky lock directory can sw...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112911 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112911 Source advisory: SNYK:PYTHON-FILELOCK-21280756...