{"id":"ghsa-ghsa-9j6q-wvj5-jgjg","seq":2056950,"kind":"advisory","title":"filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker","url":"https://github.com/advisories/GHSA-9j6q-wvj5-jgjg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9j6q-wvj5-jgjg","summary":"影響: pip:filelock >= 3.32.6, <= 4.2.0 → 4.2.1\nraise_on_not_writable_file() is the check that SoftFileLock and the locks sharing its acquire path run before every attempt. It looks at the lock path with os.lstat, so that it judges a planted symlink (a file that points at another path) by itself. When the node has no owner-write bit, it then calls os.access(filename, os.W_OK), which follows symlinks. A local user who can create entries in the lock's directory can swap the path between a mode-0466 file and a symlink to a path of their choosin…","severity":"low","techs":["python"],"cves":["CVE-2026-112912"],"tags":["GHSA-9j6q-wvj5-jgjg","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:40.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}