CVE-2026-112936 filelock: ReadWriteLock follows a symlink at the lock path into SQLite
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112936?
CVE-2026-112936 is a medium-severity vulnerability in tox-dev filelock, published on 20 Oct 2026.
Official description
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.
Which versions are affected by CVE-2026-112936?
2 open source packages ship an affected version, including filelock. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
filelock PyPI | From 3.20.4 | 4.0.9 |
filelock PyPI | From 3.20.4 | 4.0.9 |
Products include Tox-Dev Filelock.
How do I fix CVE-2026-112936?
Upgrade filelock to 4.0.9 or later.
Is CVE-2026-112936 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112936 exists.
Other vulnerabilities in tox-dev filelock
- CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
- CVE-2026-112911 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
- CVE-2025-68146 filelock has TOCTOU race condition that allows symlink attacks during lock file creation
- CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
- CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
Sources
Also known as CLEANSTART-2026-WN99561, DEBIAN-CVE-2026-112936, GHSA-j8f7-rjxc-mr56, MINI-6h74-9xmh-247x, UBUNTU-CVE-2026-112936.