## filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

- 種別: advisory
- 重大度: low
- 関連技術: python, sqlite
- CVE: CVE-2026-112913
- 公開日時: 2026-10-23T22:28:19.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-9vhv-jxww-xfm5)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-9vhv-jxww-xfm5

影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1
On Windows, ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal (pages saved to undo an interrupted write); -wal, the write-ahead log (changes kept outside the main file); and -shm, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another lo…