Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112935

filelock is a platform-independent file lock for Python

Risk score
43/100
CVSS
4.7 v3.1
Exploit chance (30 days)
0.1%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved ob…
Affected
Tox-dev Filelock before 4.2.1
Fix
Upgrade Tox-dev Filelock to 4.2.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112935Filelock is aplatform-independent file lockfor PythonCVSS 4.7 · EPSS 0%CVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112911Filelock is aplatform-independent file lockfor PythonCVSS 6.3 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%Upgrade Tox-dev Filelock4.2.1 · 4.0.9or later on your release lineWho is exposedTox-dev Filelock before 4.0.9YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 3.20.4 until4.0.9, ReadWriteLock andAsyncReadWriteLock versionsfrom 3.20.4 resolve the lockpath and pass it to SQLite…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-367 (CWE-367)47 other warnings in 30 days →Same productEarlier Tox-dev Filelock warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database cr…

The flaws

  • CVE-2026-112935: Filelock is a platform-independent file lock for Python (CVSS 4.7 · EPSS 0%)
  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112911: Filelock is a platform-independent file lock for Python (CVSS 6.3 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.2.1 · 4.0.9 or later on your release line

Who is exposed: Tox-dev Filelock before 4.0.9

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 4.7 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: python

References

Original description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.