CVE-2026-112936

Overview

CVE-2026-112936 affects the Python filelock library (versions 3.20.4 through 4.0.9) by allowing a local user to create a symbolic link in the lock directory that redirects SQLite lock creation, potentially bypassing mutual exclusion. This can lead to race conditions, data corruption, or unauthorized access to SQLite databases. The flaw is mitigated in filelock 4.0.9.

Description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

Impact

Local users on systems that rely on filelock for SQLite concurrency can compromise the integrity and availability of the database by redirecting lock files. The vulnerability may also expose sensitive data if the redirected database is accessed by unauthorized processes. Defenders should consider the potential for data corruption and unauthorized access.

Remediation

Upgrade the filelock library to version 4.0.9 or later. Restrict write and symlink permissions on the lock directory (e.g., chmod 700) to prevent local users from creating malicious links. Verify that the application uses secure lock paths and consider additional OS-level file locking mechanisms if available.

Risk context

The CVSS v3 score of 6.1 indicates a medium severity risk. No EPSS data is available, so the urgency is based solely on the severity rating and the fact that the issue is already fixed in newer releases.

Affected products

• Python filelock 3.20.4-4.0.9