File Lock Vulnerability in Python Affects Windows Users
CVE-2026-112913

3.3LOW

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
5 November 2026

What is CVE-2026-112913?

The filelock library for Python, specifically versions ranging from 3.20.4 to 4.2.1, has a vulnerability in its ReadWriteLock and AsyncReadWriteLock on Windows systems. This issue arises when using the _connect method to attach SQLite to the lock database via pathname. It allows a local account to create adjacent names, potentially placing a database write-ahead logging (WAL) or journal file, which can interfere with database operations. This situation generates sqlite3.OperationalError during any attempts to read or write if a WAL file is undeletable, and modifies permissions could result in a risk of data loss. The vulnerability stems from shared usage of a temporary directory writable by other accounts, underscoring the importance of isolating private directories. This issue has been resolved in version 4.2.1.

Affected Version(s)

filelock >= 3.20.4, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/834
x_refsource_MISC
https://github.com/tox-dev/filelock/pull/854
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.