tox-dev filelock vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202619

Newest CVEs

• CVE-2026-112908

  filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

  tox-dev · filelock

  Medium5.3
• CVE-2026-112938

  filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

  tox-dev · filelock

  Medium5.8
• CVE-2026-112907

  filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

  tox-dev · filelock

  Low2.5
• CVE-2026-112913

  filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

  tox-dev · filelock

  Low3.3
• CVE-2026-112910

  filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

  tox-dev · filelock

  Medium5.3
• CVE-2026-112941

  filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

  tox-dev · filelock

  Low3.3
• CVE-2026-112940

  filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

  tox-dev · filelock

  High7.1
• CVE-2026-112939

  filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

  tox-dev · filelock

  Medium4.7
• CVE-2026-112937

  filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

  tox-dev · filelock

  Medium6.1
• CVE-2026-112936

  filelock: ReadWriteLock follows a symlink at the lock path into SQLite

  tox-dev · filelock

  Medium6.1