filelock: ReadWriteLock follows a symlink at the lock path into SQLite
影響: pip:filelock >= 3.20.4, <= 4.0.8 → 4.0.9
ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve() and pass it to sqlite3.connect() without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's own processes. Details ReadWriteLock.__init__ stores pathlib.Path(lock_file).resolve(), which follow…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| CVE | CVE-2026-112936 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:08、GitHub Advisory Databaseが「filelock: ReadWriteLock follows a symlink at the lock path into SQLite」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python、SQLite。CVE: CVE-2026-112936。