CVE-2026-22701

Summary of CVE-2026-22701 (python-filelock) A TOCTOU race condition affects the SoftFileLock implementation in python-filelock prior to version 3.20.3. With local filesystem access and the ability to create symlinks, an attacker can exploit a race between the permission validation and file creati...

CVE-2025-68146

CVE-2025-68146 affects the Python filelock package. A TOCTOU race in lock file creation allows local attackers with filesystem access to exploit symlinks and truncate target files. The vulnerability exists in UnixFileLock and WindowsFileLock for versions before 3.20.1; an attacker can create a sy...

CVE-2026-112940

The filelock Python library contains a vulnerability in the ReadWriteLock component (versions 3.20.4 through 4.2.1) where SQLite reopens the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap file names to force the locking ...

CVE-2026-112909

The filelock Python library contains a vulnerability in UnixFileLock prior to version 4.2.1 . A local user can cause the library to truncate or change the mode of a regular file if that file is renamed or hard-linked onto the lock path by another user (who has rename permissions or a permissive h...

CVE-2026-112935

The filelock library, a platform-independent file lock for Python, is vulnerable to a TOCTOU Race Condition in its SoftFileLock component. In versions 3.22.0 through 4.2.0 , an attacker can free their own marker after a stale read. If an honest contender subsequently creates a live successor on a...

CVE-2026-112939

The filelock Python library is vulnerable to a flaw in SoftFileLock between versions 3.22.0 and 4.2.1. The root cause is that the component trusts a forged process identifier (PID) within a writable marker. This allows an authorized contender—such as another process under the same account or a ro...

CVE-2026-112936

The filelock Python library (versions 3.20.4 through 4.0.9 ) contains a vulnerability where ReadWriteLock and AsyncReadWriteLock resolve lock paths and pass them to SQLite without rejecting a final symbolic link. This allows a local user with the ability to create names in the lock directory to r...

CVE-2026-112912

The filelock Python library (versions 3.32.6 until 4.2.1) is vulnerable to a symlink swap during the SoftFileLock writability check. An attacker can manipulate symbolic links to cause the os.access check to follow a swapped link for a node lacking the owner-write bit. This allows a local user to ...

CVE-2026-112906

The filelock Python library (versions 4.1.0 through 4.2.1 ) is vulnerable to a flaw in SoftFileLock where it may reuse a stale observation from another local user's file through inode reuse . If an attacker pre-dates and removes their own marker, and specific conditions regarding modification tim...

CVE-2026-112915

The filelock Python library (versions 3.20.4 through 4.2.0 ) is vulnerable to a Denial of Service (DoS) via CWE-400 in its ReadWriteLock component. A local user capable of replacing the lock database can provide a crafted SQLite database that lacks bounded schema and query work limits. This cause...

CVE-2026-112937

The filelock Python library, a platform-independent file lock, is vulnerable in versions 4.1.0 through 4.2.0 . The ReadWriteLock component can remove a randomized .filelock-* private-hard-link directory during cleanup. A local user with rename access in a non-sticky parent directory can exploit t...

CVE-2026-112914

The filelock Python library (versions 4.1.0 through 4.2.0 ) is vulnerable to a race condition (CWE-363) in its SoftFileLock component. An attacker with local rename access in a non-sticky lock directory can swap in a symbolic link . If the runtime follows the link to a same-filesystem target, it ...

CVE-2026-112934

The filelock Python library (versions 4.0.0 through 4.2.1 ) contains a vulnerability where the SoftReadWriteLock refreshes holder records by name. A local user with rename access to the lock directory can replace a record with a named pipe , causing the lock to hang, or link a reachable target fi...

CVE-2026-112911

The filelock Python library contains a vulnerability where StrictSoftFileLock (versions 3.30.0 to 4.2.1) and SoftReadWriteLock (versions 4.0.0 to 4.2.1) can adopt a protocol directory created by another local user within a shared parent directory. This allows a malicious local user to alter the p...

CVE-2026-112941

The filelock Python library versions 4.1.0 through 4.2.1 are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition involving SoftReadWriteLock and AsyncSoftReadWriteLock . The vulnerability occurs because these components cache a successful check of the .rw lock tree but re-resolve na...