{"schema_version":1,"title":"filelock (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in filelock (PyPI): 0 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112938, was published on 5 November 2026. 18 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/filelock","json_url":"https://junglewise.ai/threats/technologies/filelock.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/filelock","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":20,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":18,"last_90_days":18,"last_365_days":20},"latest":[{"cve":"CVE-2026-112938","cvss":5.8,"slug":"cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in","title":"filelock StrictSoftFileLock symlink race privilege escalation","severity":"medium","exploited":false,"published_at":"2026-11-05T22:17:47.213+00:00","url":"https://junglewise.ai/threats/cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in"},{"cve":"CVE-2026-112913","cvss":3.3,"slug":"cve-2026-112913-filelock-readwritelock-on-windows-acts-on-sqlite-side-files","title":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","severity":"low","exploited":false,"published_at":"2026-11-05T22:17:47.043+00:00","url":"https://junglewise.ai/threats/cve-2026-112913-filelock-readwritelock-on-windows-acts-on-sqlite-side-files"},{"cve":"CVE-2026-112910","cvss":5.3,"slug":"cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the","title":"filelock WindowsFileLock mode parameter permission enforcement failure","severity":"medium","exploited":false,"published_at":"2026-11-05T22:17:46.877+00:00","url":"https://junglewise.ai/threats/cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the"},{"cve":"CVE-2026-112908","cvss":5.3,"slug":"cve-2026-112908-filelock-strictsoftfilelock-creates-its-claim-directories","title":"filelock StrictSoftFileLock directory permission bypass","severity":"medium","exploited":false,"published_at":"2026-11-05T22:17:46.693+00:00","url":"https://junglewise.ai/threats/cve-2026-112908-filelock-strictsoftfilelock-creates-its-claim-directories"},{"cve":"CVE-2026-112907","cvss":3.1,"slug":"cve-2026-112907-filelock-on-windows-an-oplock-on-a-soft-lock-s-marker-holds","title":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","severity":"low","exploited":false,"published_at":"2026-11-05T22:17:46.513+00:00","url":"https://junglewise.ai/threats/cve-2026-112907-filelock-on-windows-an-oplock-on-a-soft-lock-s-marker-holds"},{"cve":"CVE-2026-112941","cvss":3.3,"epss":0.0013,"slug":"cve-2026-112941-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and…","severity":"low","exploited":false,"published_at":"2026-10-20T15:17:16.973+00:00","url":"https://junglewise.ai/threats/cve-2026-112941-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-112940","cvss":7.1,"epss":0.0019,"slug":"cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock SQLite database overwrite in POSIX","severity":"high","exploited":false,"published_at":"2026-10-20T15:17:16.827+00:00","url":"https://junglewise.ai/threats/cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112939","cvss":4.7,"epss":0.0014,"slug":"cve-2026-112939-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock SoftFileLock PID spoofing privilege escalation","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.663+00:00","url":"https://junglewise.ai/threats/cve-2026-112939-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112937","cvss":6.1,"epss":0.0016,"slug":"cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock ReadWriteLock insecure temporary directory cleanup","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.527+00:00","url":"https://junglewise.ai/threats/cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-112936","cvss":6.1,"epss":0.0023,"slug":"cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock symlink following vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.383+00:00","url":"https://junglewise.ai/threats/cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112935","cvss":4.7,"epss":0.0013,"slug":"cve-2026-112935-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock SoftFileLock file lock bypass","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.243+00:00","url":"https://junglewise.ai/threats/cve-2026-112935-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112934","cvss":6.1,"epss":0.0023,"slug":"cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0","title":"filelock SoftReadWriteLock directory traversal and lock stalling","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.1+00:00","url":"https://junglewise.ai/threats/cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0"},{"cve":"CVE-2026-112915","cvss":5.5,"epss":0.0022,"slug":"cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock unbounded SQLite query denial of service","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.953+00:00","url":"https://junglewise.ai/threats/cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112914","cvss":5.3,"epss":0.0016,"slug":"cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock SoftFileLock symlink attack via stale marker","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.81+00:00","url":"https://junglewise.ai/threats/cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-112912","cvss":3.1,"epss":0.0021,"slug":"cve-2026-112912-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker","severity":"low","exploited":false,"published_at":"2026-10-20T15:17:15.657+00:00","url":"https://junglewise.ai/threats/cve-2026-112912-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112911","cvss":6.3,"epss":0.0015,"slug":"cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock StrictSoftFileLock directory adoption vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.473+00:00","url":"https://junglewise.ai/threats/cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112909","cvss":6.1,"epss":0.0022,"slug":"cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to","title":"filelock UnixFileLock file truncation on rename","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.313+00:00","url":"https://junglewise.ai/threats/cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to"},{"cve":"CVE-2026-112906","cvss":4.7,"epss":0.0021,"slug":"cve-2026-112906-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock SoftFileLock stale marker reuse race condition","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.163+00:00","url":"https://junglewise.ai/threats/cve-2026-112906-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-22701","cvss":3.1,"epss":0.0013,"slug":"cve-2026-22701-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability","title":"PYSEC-2026-1374 - filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:18.208767+00:00","url":"https://junglewise.ai/threats/cve-2026-22701-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability"},{"cve":"CVE-2025-68146","cvss":3.1,"epss":0.002,"slug":"cve-2025-68146-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks","title":"PYSEC-2026-1375 - filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:13.114668+00:00","url":"https://junglewise.ai/threats/cve-2025-68146-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"tensorflow (PyPI)","slug":"pypi-tensorflow","vulnerabilities":435,"url":"https://junglewise.ai/threats/technologies/pypi-tensorflow"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":430,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":427,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":177,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"Django (PyPI)","slug":"django","vulnerabilities":173,"url":"https://junglewise.ai/threats/technologies/django"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":159,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"pillow (PyPI)","slug":"pillow","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/pillow"},{"name":"praisonai (PyPI)","slug":"pypi-praisonai","vulnerabilities":120,"url":"https://junglewise.ai/threats/technologies/pypi-praisonai"},{"name":"vllm (PyPI)","slug":"pypi-vllm","vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/pypi-vllm"},{"name":"plone (PyPI)","slug":"pypi-plone","vulnerabilities":101,"url":"https://junglewise.ai/threats/technologies/pypi-plone"},{"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":88,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/picklescan"}],"technology":{"hub":true,"name":"filelock (PyPI)","slug":"filelock","vendor":{"hub":true,"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"description":"A file-based lock mechanism for synchronizing file access across processes.","url":"https://junglewise.ai/threats/technologies/filelock"},"most_severe":[{"cve":"CVE-2026-112940","cvss":7.1,"epss":0.0019,"slug":"cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock SQLite database overwrite in POSIX","severity":"high","exploited":false,"published_at":"2026-10-20T15:17:16.827+00:00","url":"https://junglewise.ai/threats/cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112911","cvss":6.3,"epss":0.0015,"slug":"cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock StrictSoftFileLock directory adoption vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.473+00:00","url":"https://junglewise.ai/threats/cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112936","cvss":6.1,"epss":0.0023,"slug":"cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock symlink following vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.383+00:00","url":"https://junglewise.ai/threats/cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112934","cvss":6.1,"epss":0.0023,"slug":"cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0","title":"filelock SoftReadWriteLock directory traversal and lock stalling","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.1+00:00","url":"https://junglewise.ai/threats/cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0"},{"cve":"CVE-2026-112909","cvss":6.1,"epss":0.0022,"slug":"cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to","title":"filelock UnixFileLock file truncation on rename","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.313+00:00","url":"https://junglewise.ai/threats/cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to"},{"cve":"CVE-2026-112937","cvss":6.1,"epss":0.0016,"slug":"cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock ReadWriteLock insecure temporary directory cleanup","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:16.527+00:00","url":"https://junglewise.ai/threats/cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-112938","cvss":5.8,"slug":"cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in","title":"filelock StrictSoftFileLock symlink race privilege escalation","severity":"medium","exploited":false,"published_at":"2026-11-05T22:17:47.213+00:00","url":"https://junglewise.ai/threats/cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in"},{"cve":"CVE-2026-112915","cvss":5.5,"epss":0.0022,"slug":"cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3","title":"filelock ReadWriteLock unbounded SQLite query denial of service","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.953+00:00","url":"https://junglewise.ai/threats/cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3"},{"cve":"CVE-2026-112914","cvss":5.3,"epss":0.0016,"slug":"cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1","title":"filelock SoftFileLock symlink attack via stale marker","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:15.81+00:00","url":"https://junglewise.ai/threats/cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1"},{"cve":"CVE-2026-112910","cvss":5.3,"slug":"cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the","title":"filelock WindowsFileLock mode parameter permission enforcement failure","severity":"medium","exploited":false,"published_at":"2026-11-05T22:17:46.877+00:00","url":"https://junglewise.ai/threats/cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}