Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112915

filelock is a platform-independent file lock for Python

Risk score
50/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.2%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-ins…
Affected
Tox-dev Filelock before 4.2.1
Fix
Upgrade Tox-dev Filelock to 4.2.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112915Filelock is aplatform-independent file lockfor PythonCVSS 5.5 · EPSS 0%CVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112911Filelock is aplatform-independent file lockfor PythonCVSS 6.3 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%Upgrade Tox-dev Filelock4.2.1 · 4.0.9or later on your release lineWho is exposedTox-dev Filelock before 4.0.9YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 3.20.4 until4.0.9, ReadWriteLock andAsyncReadWriteLock versionsfrom 3.20.4 resolve the lockpath and pass it to SQLite…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)253 other warnings in 30 days →Same productEarlier Tox-dev Filelock warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database cr…

The flaws

  • CVE-2026-112915: Filelock is a platform-independent file lock for Python (CVSS 5.5 · EPSS 0%)
  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112911: Filelock is a platform-independent file lock for Python (CVSS 6.3 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.2.1 · 4.0.9 or later on your release line

Who is exposed: Tox-dev Filelock before 4.0.9

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: python

References

Original description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.