CVE-2026-112936
mediumfilelock is a platform-independent file lock for Python.
Vendor / product: Tox-dev — filelock
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.
CVSS
6.1
6.1 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-20 15:17
Modified: 2026-10-21 18:09
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:04 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
tox-dev / filelock ≥3.20.4 <4.0.9
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04 security-advisories@github.com
- https://github.com/tox-dev/filelock/releases/tag/4.0.9 security-advisories@github.com
- https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56 security-advisories@github.com
- https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:04 UTC · record ↗