CVE-2026-112940: filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelock ReadWriteLockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
POSIX deployments using filelock ReadWriteLock are exposed when an attacker has rename access in a non-sticky parent directory containing the lock database names. The affected filelock versions are 3.20.4 through versions before 4.2.1.
What does an attacker need to achieve an attacker-controlled file overwrite?
The attacker needs the ability to replace the SQLite lock database or side-file names through rename access in a non-sticky parent directory. For overwrites with attacker-chosen content, a writable adjacent hot journal is additionally required.
What can happen without a writable adjacent hot journal?
An attacker may still use planted symlinks or journal files to cause the lock user's process to perform overwrite or unlink operations on its own files. The additional hot-journal condition applies specifically to attacker-chosen content overwrites.
What should be done if upgrading is not immediately possible?
Restrict untrusted users from rename access to the relevant parent directory, and ensure that parent directories are sticky where appropriate. Prevent attackers from planting or replacing the SQLite lock database names and adjacent journal files.