filelock: ReadWriteLock follows a symlink at the lock path into SQLite

影響: pip:filelock >= 3.20.4, <= 4.0.8 → 4.0.9

ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve() and pass it to sqlite3.connect() without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the victim's process create, lock, or write the file it points to, or break mutual exclusion between the victim's own processes. Details ReadWriteLock.__init__ stores pathlib.Path(lock_file).resolve(), which follow…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:08, GitHub Advisory Database에서 "filelock: ReadWriteLock follows a symlink at the lock path into SQLite"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python, SQLite. CVE: CVE-2026-112936.