filelock vulnerabilities
CVEs whose affected-version data names the filelock package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
19 CVEsRSS
CVE-2026-112938Medium· 5.8filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
CVE-2026-112910Medium· 5.3filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
CVE-2026-112908Medium· 5.3filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
CVE-2026-112909Medium· 6.1PoCfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
CVE-2026-112911Medium· 6.3PoCfilelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
CVE-2026-112912Low· 2.5PoCfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
CVE-2026-112915Medium· 5.5PoCfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
CVE-2026-112934Medium· 6.1PoCfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
CVE-2026-112935Medium· 4.7PoCfilelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
CVE-2026-112936Medium· 6.1PoCfilelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
CVE-2026-112939Medium· 4.7PoCfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
CVE-2026-112941Low· 3.3PoCfilelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
CVE-2026-112907Low· 2.5filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
CVE-2026-112913Low· 3.3filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
CVE-2026-112940High· 7.1PoCfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2025-68146Medium· 6.3filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation