Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112913— filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

Quick assessment

Affected
tox-dev filelock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

filelock 是一个跨平台的 Python 文件锁工具。在版本 3.20.4 至 4.2.1 期间，Windows 上的 ReadWriteLock 和 AsyncReadWriteLock 使用 _connect 方法通过路径名将 SQLite 连接到锁数据库，这使得另一个能够创建相邻名称的本地账户可以在锁获取之前放置数据库的 WAL（预写日志）或 journal（日志）侧文件。一个无法删除的 WAL 文件会导致每次读取或写入锁的获取立即失败，并抛出 sqlite3.OperationalError 异常，无

CVSS 3.3 · Low

Possible ATT&CK Techniques 2 AI

T1562.006 T1562.004
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112913

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
Source: CVE Program / CVE List V5
Vulnerability Description
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use _connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to place a database-wal or database-journal side file before acquisition. An undeletable WAL file makes each read or write acquisition fail immediately with sqlite3.OperationalError regardless of timeout. Separately, when the database contains at least one table, a hot journal that grants the lock account modify rights can cause SQLite recovery to delete a file named by that journal only when the lock account has permission to delete the target. The issue requires a directory writable by another account, such as a shared Windows temporary directory, and does not affect private directories. This issue is fixed in version 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tox-dev filelock >= 3.20.4, < 4.2.1 -

II. Public POCs for CVE-2026-112913

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112913

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112913 (1)

Other References for CVE-2026-112913 (3)

Same Patch Batch · tox-dev · 2026-11-05 · 5 CVEs total

CVE-2026-112938 5.8 MEDIUM filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and cre
CVE-2026-112908 5.3 MEDIUM filelock: StrictSoftFileLock creates its claim directories without the lock mode, so anoth
CVE-2026-112910 5.3 MEDIUM filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database i
CVE-2026-112907 2.5 LOW filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past i

IV. Related Vulnerabilities

Same product: filelock
Same vendor: tox-dev
Same weakness: CWE-367