CVE-2026-112936

What it actually does

ReadWriteLock and AsyncReadWriteLock in filelock 3.20.4-4.0.8 resolve the final component of the lock path and pass the result to SQLite without rejecting a trailing symbolic link, allowing the database file creation and locking operations to be redirected or have mutual exclusion split across distinct targets.

Why it matters to the business

Applications relying on filelock for coordination can experience corrupted state or loss of exclusive access when a local user on the same system creates malicious links in the lock directory, increasing risk of data integrity issues or service disruption in multi-user environments.

How an attack unfolds

A local attacker with write access to the directory containing the lock file creates a symbolic link that points to a target chosen by the attacker; when the vulnerable library resolves the path and hands it to SQLite, the lock database is created or operated on at the attacker-chosen location, bypassing intended mutual exclusion or allowing split locking between processes.

How to fix it

Upgrade the filelock package to version 4.0.9 or newer; after upgrade, verify that lock-path resolution now rejects trailing symbolic links before passing the path to SQLite.

How to confirm the fix worked

Confirm installed filelock version is 4.0.9 or later via package metadata; test by attempting to create a trailing symlink in a lock directory and verifying that lock operations fail or are rejected rather than following the link.

Typical attack path

1. Locate a directory writable by the attacker that will contain a filelock-managed lock path
2. Create a symbolic link whose final component matches the expected lock filename but redirects to an attacker-controlled location
3. Trigger or wait for a process using ReadWriteLock or AsyncReadWriteLock to perform lock acquisition
4. Observe or abuse the redirected SQLite database to violate intended mutual exclusion or corrupt lock state

How to detect it

Inspect Python process working directories and temporary lock paths for unexpected symbolic links created around the time of lock-related errors; review application and system logs for SQLite failures or lock-acquisition anomalies that coincide with file-creation events by unprivileged local users.

What your security team should do

• Immediately update filelock to 4.0.9 across all Python environments and dependency manifests
• Scan for and replace any pinned versions between 3.20.4 and 4.0.8
• Review applications that use ReadWriteLock or AsyncReadWriteLock for shared-resource coordination and add defense-in-depth checks for symlink attacks
• Prioritize patching on multi-user systems where the exploit-maturity indicator shows public code is already available