CVE-2026-112910

filelock on Windows ignores the "mode" argument. "FileLockpath, mode=0o600" creates the same file as "FileLockpath": one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files...

GHSA-CWQR-HH33-GH44 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock run PRAGMA journalmode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema the sqlitemaster table, which lists every table and index with its CREATE text of whatever file sits a...

EUVD-2026-105021

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout...

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock run PRAGMA journalmode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema the sqlitemaster table, which lists every table and index with its CREATE text of whatever file sits a...

GHSA-J8F7-RJXC-MR56 filelock: ReadWriteLock follows a symlink at the lock path into SQLite

Summary ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve and pass it to sqlite3.connect without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the...

EUVD-2026-105026

filelock: ReadWriteLock follows a symlink at the lock path into SQLite...

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

Summary ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve and pass it to sqlite3.connect without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the...

EUVD-2026-105028

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory name...

GHSA-JQC4-5CVW-7W85 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

GHSA-9VHV-JXWW-XFM5 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

GHSA-V4X8-3WR5-3WQ8 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

EUVD-2026-105031

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files...

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

PT-2026-122428

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122459

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

SUSE CVE-2026-112915

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

SUSE CVE-2026-112936

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory t...

SUSE CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...