tox-dev/filelock Security Advisories | GitStock

medium2026-10-23

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

GHSA-jqc4-5cvw-7w85 · CVE-2026-112937

low2026-10-23

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

GHSA-9vhv-jxww-xfm5 · CVE-2026-112913

low2026-10-23

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

GHSA-567q-5qvw-pf92 · CVE-2026-112907

medium2026-10-23

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

GHSA-2g95-wg33-c5x2 · CVE-2026-112906

medium2026-10-23

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

GHSA-crv4-6mhj-j5jh · CVE-2026-112914

high2026-10-23

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

GHSA-v4x8-3wr5-3wq8 · CVE-2026-112940

medium2026-01-13

filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

GHSA-qmgc-5h2g-mvrw · CVE-2026-22701

medium2025-12-16

filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

GHSA-w853-jp5j-5j7f · CVE-2025-68146