CVE-2026-112936

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

• CWE-59
• CWE-668

• https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04Patch
• https://github.com/tox-dev/filelock/releases/tag/4.0.9Release Notes
• https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56Exploit, Vendor Advisory
• https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56Exploit, Vendor Advisory

Published

Oct 20, 2026

Last Modified

Oct 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112915filelock is a platform-independent file lock for Python. Fro…5.5
• CVE-2026-11292Insufficient policy enforcement in Blink in Google Chrome pr…4.3
• CVE-2026-112921Robots::Validate versions from 0.4.3 before 0.4.10 for Perl …
• CVE-2026-11293Use after free in Input in Google Chrome prior to 149.0.7827…9.6
• CVE-2026-112934filelock is a platform-independent file lock for Python. Fro…6.1
• CVE-2026-112935filelock is a platform-independent file lock for Python. Fro…4.7
• CVE-2026-112937filelock is a platform-independent file lock for Python. Fro…6.1
• CVE-2026-112939filelock is a platform-independent file lock for Python. Fro…4.7
• CVE-2026-11294Inappropriate implementation in Passwords in Google Chrome p…4.3
• CVE-2026-112940filelock is a platform-independent file lock for Python. Fro…7.1
• CVE-2026-112941filelock is a platform-independent file lock for Python. Fro…3.3
• CVE-2026-112942launch-editor allows users to open files with line numbers i…7.5