## filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-112937
- 公開日時: 2026-10-23T22:28:41.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jqc4-5cvw-7w85)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jqc4-5cvw-7w85

影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1
ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…