# filelock (PyPI) vulnerabilities 20 known vulnerabilities (1 high, 15 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.9 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 4.2.9 (Nov 4, 2026), the latest release - Weekly downloads: 138.8M - Dependents: 47.2K - Releases: 143 since 0.2.0 (Jul 6, 2014) - Registry: https://pypi.org/project/filelock/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-112908: 3.30.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112938: 3.30.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112907: 3.22.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112913: 3.20.4 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112910: 3.10.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112941: 4.1.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112940: 3.20.4 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112939: 3.22.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112937: 4.1.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112936: 3.20.4 to 4.0.8 (4.0.9 is outside it) - CVE-2026-112935: 3.22.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112934: 4.0.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112915: 3.20.4 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112914: 4.1.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112912: 3.32.6 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112911: 3.30.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112909: 0.2.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-112906: 4.1.0 to 4.2.0 (4.2.1 is outside it) - CVE-2026-22701: 0.2.0 to 3.20.2 (3.20.3 is outside it) - CVE-2025-68146: 0.2.0 to 3.20.0 (3.20.1 is outside it) ## Advisories (20) ### [CVE-2026-112908](https://cve.now/CVE-2026-112908): filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a… - Severity: Medium 5.3 - Published: Nov 5, 2026 - Affected: from 3.30.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112938](https://cve.now/CVE-2026-112938): filelock: StrictSoftFileLock follows a symbolic link swapped in at \.filelock and creates claim files in a directory another local… - Severity: Medium 5.8 - Published: Nov 5, 2026 - Affected: from 3.30.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112907](https://cve.now/CVE-2026-112907): filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break - Severity: Low 2.5 - Published: Nov 5, 2026 - Affected: from 3.22.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112913](https://cve.now/CVE-2026-112913): filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database - Severity: Low 3.3 - Published: Nov 5, 2026 - Affected: from 3.20.4, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112910](https://cve.now/CVE-2026-112910): filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL - Severity: Medium 5.3 - Published: Nov 5, 2026 - Affected: from 3.10.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112941](https://cve.now/CVE-2026-112941): filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock - Severity: Low 3.3 - Published: Oct 20, 2026 - Affected: from 4.1.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112940](https://cve.now/CVE-2026-112940): filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files - Severity: High 7.1 - Published: Oct 20, 2026 - Affected: from 3.20.4, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112939](https://cve.now/CVE-2026-112939): filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker - Severity: Medium 4.7 - Published: Oct 20, 2026 - Affected: from 3.22.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112937](https://cve.now/CVE-2026-112937): filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-\* link directory name - Severity: Medium 6.1 - Published: Oct 20, 2026 - Affected: from 4.1.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112936](https://cve.now/CVE-2026-112936): filelock: ReadWriteLock follows a symlink at the lock path into SQLite - Severity: Medium 6.1 - Published: Oct 20, 2026 - Affected: from 3.20.4, fixed in 4.0.9. - Fixed in 4.0.9 (released Oct 1, 2026, 19 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112935](https://cve.now/CVE-2026-112935): filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders - Severity: Medium 4.7 - Published: Oct 20, 2026 - Affected: from 3.22.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112934](https://cve.now/CVE-2026-112934): filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record - Severity: Medium 6.1 - Published: Oct 20, 2026 - Affected: from 4.0.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112915](https://cve.now/CVE-2026-112915): filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout - Severity: Medium 5.5 - Published: Oct 20, 2026 - Affected: from 3.20.4, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112914](https://cve.now/CVE-2026-112914): filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory - Severity: Medium 5.3 - Published: Oct 20, 2026 - Affected: from 4.1.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112912](https://cve.now/CVE-2026-112912): filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker - Severity: Low 2.5 - Published: Oct 20, 2026 - Affected: from 3.32.6, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112911](https://cve.now/CVE-2026-112911): filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 3.30.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112909](https://cve.now/CVE-2026-112909): filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path - Severity: Medium 6.1 - Published: Oct 20, 2026 - Affected: fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-112906](https://cve.now/CVE-2026-112906): filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse - Severity: Medium 4.7 - Published: Oct 20, 2026 - Affected: from 4.1.0, fixed in 4.2.1. - Fixed in 4.2.1 (released Oct 17, 2026, 3 days before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2026-22701](https://cve.now/CVE-2026-22701): filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock - Severity: Medium 5.3 - Published: Jan 10, 2026 - Affected: fixed in 3.20.3. - Fixed in 3.20.3 (released Jan 9, 2026, 1 day before disclosure). - The latest release, 4.2.9, is not affected. ### [CVE-2025-68146](https://cve.now/CVE-2025-68146): filelock has TOCTOU race condition that allows symlink attacks during lock file creation - Severity: Medium 6.3 - Published: Dec 16, 2025 - Affected: fixed in 3.20.1. - Fixed in 3.20.1 (released Dec 15, 2025, 1 day before disclosure). - The latest release, 4.2.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/filelock Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.