CVE-2026-112936: falha de média gravidade em tox-dev filelock
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.2%
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
tox-dev · filelockCVEs relacionadas — tox-dev filelock
No mesmo produto, das mais perigosas para as menos.
CVE-2026-112934MEDIUMfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-112915MEDIUMfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutEPSS 0.2%CVE-2026-112912LOWfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%CVE-2026-112940HIGHfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own filesEPSS 0.2%