low · CVSS v3 2.5

CVE-2026-112912

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symb…

Description

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.

Scores

Severity
low
CVSS v2
—
CVSS v3
2.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-112941

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.

View analysis

low

CVE-2026-110034

The Salon Booking System WordPress plugin prior to 10.31.11 allows an unauthenticated user to apply a discount code that results in a negative booking total. This occurs because the plugin does not enforce a minimum of zero when subtracting the discount. The vulnerability can lead to negative balances and potential accounting issues.

View analysis

low

CVE-2026-111935

NoteGen 0.38.3 allows attackers with write access to a sync target to supply absolute or file:// URLs that cause the chat image analysis component to read local files and send them to an external AI provider. This can expose sensitive data stored on the victim’s machine. The flaw is due to lack of validation on the sourceUrl field.

View analysis

low

CVE-2026-112288

Krayin CRM versions 2.2.5 and 2.2.6 are vulnerable to a server‑side request forgery via webhook permission bypass that allows attackers to force internal requests using DNS rebinding. The flaw enables blind requests to internal services and cloud metadata endpoints. This can expose sensitive internal resources to unauthorized users.

View analysis