CVE-2026-112940
EUVD-2026-10503120.10.2026, 15:17
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| tox-dev | filelock | 3.20.4 ≤ 𝑥 < 4.2.1 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
- CWE-363 - Race Condition Enabling Link FollowingThe software checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the software to access the wrong file.
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.