Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112936

filelock is a platform-independent file lock for Python

Risk score
54/100
CVSS
6.1 v3.1
Exploit chance (30 days)
0.2%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database cr…
Affected
Tox-dev Filelock before 4.0.9
Fix
Upgrade Tox-dev Filelock to 4.0.9 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112911Filelock is aplatform-independent file lockfor PythonCVSS 6.3 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%CVE-2026-112934Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%Upgrade Tox-dev Filelock4.0.9 · 4.2.1or later on your release lineWho is exposedTox-dev Filelock before 4.0.9YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 3.20.4 until4.0.9, ReadWriteLock andAsyncReadWriteLock versionsfrom 3.20.4 resolve the lockpath and pass it to SQLite…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-59 (CWE-59)77 other warnings in 30 days →Same productEarlier Tox-dev Filelock warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database cr…

The flaws

  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112911: Filelock is a platform-independent file lock for Python (CVSS 6.3 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)
  • CVE-2026-112934: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.0.9 · 4.2.1 or later on your release line

Who is exposed: Tox-dev Filelock before 4.0.9

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: python

References

Original description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

Last activity 20 Oct 2026. Patch Forecast updates every hour.