{"id":"ghsa-ghsa-jqc4-5cvw-7w85","seq":661277,"kind":"advisory","title":"filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name","url":"https://github.com/advisories/GHSA-jqc4-5cvw-7w85","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jqc4-5cvw-7w85","summary":"影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1\nReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…","severity":"medium","techs":["python"],"cves":["CVE-2026-112937"],"tags":["GHSA-jqc4-5cvw-7w85","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:28:41.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}