filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1
ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…
| CVE | CVE-2026-112937 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 07:28, GitHub Advisory Database에서 "filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-112937.