CVEvulnerability

CVE-2026-112940

7.1 HIGH Published 2026-10-20 Modified 2026-10-22 Official page ↗
Status
Modified
Published
2026-10-20
Last modified
2026-10-22
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-363, CWE-59

Description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.

Affected configurations

• tox-dev filelock (>= 3.20.4 < 4.2.1)

Related

Weakness · CWE (2)

  • CWE-363 Race Condition Enabling Link Following weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References