Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-112936filelock: ReadWriteLock follows a symlink at the lock path into SQLite

Medium 6.1

In plain English

A medium-severity security flaw in filelock from tox-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-filelock	no fix listed	DEBIAN-CVE-2026-112936
Debian:13	python-filelock	no fix listed	DEBIAN-CVE-2026-112936
Debian:14	python-filelock	4.0.12-1	DEBIAN-CVE-2026-112936
PyPI	filelock	4.0.9	GHSA-j8f7-rjxc-mr56
Ubuntu:26.04:LTS	python-filelock	no fix listed	UBUNTU-CVE-2026-112936
Ubuntu:26.10	python-filelock	no fix listed	UBUNTU-CVE-2026-112936

Affected products (as reported)

Vendor	Product	Versions
tox-dev	filelock	>= 3.20.4, < 4.0.9

Weakness: CWE-59, CWE-668 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56 x_refsource_CONFIRM
https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04 x_refsource_MISC
https://github.com/tox-dev/filelock/releases/tag/4.0.9 x_refsource_MISC