Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112934

filelock is a platform-independent file lock for Python

Risk score
52/100
CVSS
6.1 v3.1
Exploit chance (30 days)
0.1%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable …
Affected
Tox-dev Filelock before 4.2.1
Fix
Upgrade Tox-dev Filelock to 4.2.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112934Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112911Filelock is aplatform-independent file lockfor PythonCVSS 6.3 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%Upgrade Tox-dev Filelock4.2.1 · 4.0.9or later on your release lineWho is exposedTox-dev Filelock before 4.0.9YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 3.20.4 until4.0.9, ReadWriteLock andAsyncReadWriteLock versionsfrom 3.20.4 resolve the lockpath and pass it to SQLite…Where it standsPublic proof of conceptCONNECTS TOSame productEarlier Tox-dev Filelock warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database cr…

The flaws

  • CVE-2026-112934: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112911: Filelock is a platform-independent file lock for Python (CVSS 6.3 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.2.1 · 4.0.9 or later on your release line

Who is exposed: Tox-dev Filelock before 4.0.9

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: python

References

Original description

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.