filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

On Windows, ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: <database-journal, the rollback journal (pages saved to undo an interrupted write); <database-wal, the write-ahead log (changes kept outside the main file); and <database-shm, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone DELETE on it, which a file's creator may do. C:\Windows\Temp (the temporary directory of services, granting BUILTIN\Users create but not delete) and C:\Users\Public are such directories. With a -wal in place, every readlock() and writelock() of the user running the lock (below: the lock user)…

Published by the source

23 Oct 2026, 22:28 UTC

Last modified by the source

23 Oct 2026, 22:45 UTC

Source last checked

26 Oct 2026, 13:56 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-9vhv-jxww-xfm5

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-9vhv-jxww-xfm5

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-9vhv-jxww-xfm5

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-112913

Advisory: filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
IDs: CVE-2026-112913, GHSA-9vhv-jxww-xfm5
Record: https://patchnext.com/advisories/cve-2026-112913 (revision 3, source checked 26 Oct 2026, 13:56 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 3.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: filelock 4.2.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI filelock: affected >= 3.20.4, <= 4.2.0; fixed in 4.2.1

## Suggested inspection (read-only)
- `python -m pip show filelock`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on filelock.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-9vhv-jxww-xfm5 (GitHub-reviewed advisory GHSA-9vhv-jxww-xfm5 lists affected ranges: PyPI filelock >=3.20.4 <=4.2.0)
- Verified: https://osv.dev/vulnerability/GHSA-9vhv-jxww-xfm5 (OSV record GHSA-9vhv-jxww-xfm5 lists affected ranges: PyPI filelock >=3.20.4 <4.2.1 (fixed))

Commands are suggestions: review each one before running it.