{"id":"ghsa-ghsa-j8f7-rjxc-mr56","seq":2056952,"kind":"advisory","title":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","url":"https://github.com/advisories/GHSA-j8f7-rjxc-mr56","permalink":"https://vulnpulse.app/items/ghsa-ghsa-j8f7-rjxc-mr56","summary":"影響: pip:filelock >= 3.20.4, <= 4.0.8 → 4.0.9\nReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve() and pass it to sqlite3.connect() without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's own processes. Details ReadWriteLock.__init__ stores pathlib.Path(lock_file).resolve(), which follow…","severity":"medium","techs":["python","sqlite"],"cves":["CVE-2026-112936"],"tags":["GHSA-j8f7-rjxc-mr56","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:30.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}