CVE-2026-112941

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the...

CVE-2026-112941 filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112940 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112940 Source advisory: MEND:CVE-2026-112940...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

The filelock Python library contains a vulnerability in the ReadWriteLock component (versions 3.20.4 through 4.2.1) where SQLite reopens the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap file names to force the locking ...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112939 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112939 Source advisory: MEND:CVE-2026-112939...

CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939

The filelock Python library is vulnerable to a flaw in SoftFileLock between versions 3.22.0 and 4.2.1. The root cause is that the component trusts a forged process identifier (PID) within a writable marker. This allows an authorized contender—such as another process under the same account or a ro...

CVE-2026-112937 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...

CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...