CVE-2026-112936: filelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using filelock ReadWriteLock or AsyncReadWriteLock on versions 3.20.4 through 4.0.8 are exposed when another local user can create entries in the directory containing the lock path. The issue concerns lock paths that can be replaced with a final symbolic link.
What must an attacker be able to do?
An attacker needs local access and the ability to create names in the lock directory. They can use a symbolic link at the lock path to redirect SQLite database creation and locking, potentially splitting mutual exclusion between different targets.
Are default filelock locks affected?
The provided information identifies ReadWriteLock and AsyncReadWriteLock specifically. It does not state that other filelock lock types are affected.
What should be done if the application cannot be upgraded immediately?
Ensure untrusted local users cannot create or replace names in directories used for ReadWriteLock or AsyncReadWriteLock lock files. Use lock directories whose ownership and permissions prevent symbolic-link creation by other users.
How can I determine whether my deployment is affected?
Check whether filelock is version 3.20.4 through 4.0.8 and whether the application uses ReadWriteLock or AsyncReadWriteLock. Also review whether other local users can create entries in the directory containing the configured lock path.