Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

filelock

20 known vulnerabilities (1 high, 15 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
4.2.9 (Nov 4, 2026): no advisory affects it
Newest unaffected release
4.2.9 (Nov 4, 2026), the latest release
Advisories
20 · 1 high, 15 medium, 4 low
Weekly downloads
138.8M
Dependents
47.2K
Releases
143 since 0.2.0 (Jul 6, 2014)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 20 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

  • CVE-2026-112908Medium 5.3

    filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a…

    Affected: from 3.30.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112938Medium 5.8

    filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local…

    Affected: from 3.30.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

    Affected: from 3.22.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

    Affected: from 3.20.4, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112910Medium 5.3

    filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

    Affected: from 3.10.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

    Affected: from 4.1.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

    Affected: from 3.20.4, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112939Medium 4.7

    filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

    Affected: from 3.22.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112937Medium 6.1

    filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

    Affected: from 4.1.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112936Medium 6.1

    filelock: ReadWriteLock follows a symlink at the lock path into SQLite

    Affected: from 3.20.4, fixed in 4.0.9.

    Fixed in 4.0.9 (released Oct 1, 2026, 19 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112935Medium 4.7

    filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

    Affected: from 3.22.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112934Medium 6.1

    filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

    Affected: from 4.0.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112915Medium 5.5

    filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

    Affected: from 3.20.4, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112914Medium 5.3

    filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

    Affected: from 4.1.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

    Affected: from 3.32.6, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

Show all 20 advisoriesShow fewer advisories
  • CVE-2026-112911Medium 6.3

    filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

    Affected: from 3.30.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112909Medium 6.1

    filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

    Affected: fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-112906Medium 4.7

    filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

    Affected: from 4.1.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2026-22701Medium 5.3

    filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

    Affected: fixed in 3.20.3.

    Fixed in 3.20.3 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 4.2.9, is not affected.

  • CVE-2025-68146Medium 6.3

    filelock has TOCTOU race condition that allows symlink attacks during lock file creation

    Affected: fixed in 3.20.1.

    Fixed in 3.20.1 (released Dec 15, 2025, 1 day before disclosure).

    The latest release, 4.2.9, is not affected.