filelock has 7 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-367 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…51CVE-2026-112906Medium· 4.7filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse38CVE-2025-68146Medium· 6.3filelock has a TOCTOU race condition which allows symlink attacks during lock file creation35CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name34CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…29
filelock vulnerabilities
CVEs affecting filelock, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-112907Low· 2.5filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
CVE-2026-112913Low· 3.3filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
CVE-2026-112940High· 7.1PoCfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2025-68146Medium· 6.3filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation