Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filelock | pip | >= 3.20.4, <= 4.2.0 | 4.2.1 |
Miggo AIRoot Cause AnalysisCVE-2026-112913 is a Windows-only TOCTOU/side-file vulnerability in filelock's SQLite-backed ReadWriteLock and AsyncReadWriteLock. The root cause is that the Windows branch of _connect (in src/filelock/_read_write.py) passes the database path directly to sqlite3.connect(database, ...) in every directory. SQLite derives the -journal, -wal, and -shm side-file names from that path and acts on whichever of those files it finds beside the database before running any statement. In a directory where another local account can create files but not delete the lock user's files (e.g. C:\Windows\Temp, C:\Users\Public), that account can plant a -wal (denying DELETE) to make every read_lock()/write_lock() raise sqlite3.OperationalError: disk I/O error, or plant a -journal to make SQLite replay it and delete a file the journal names.
The fix (PR #854, commit 5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d) rewrites the Windows connection path: _connect now reads the directory's ACL via _directory_is_private and, when accounts other than the locking account/SYSTEM/Administrators can add or remove names, creates a private .filelock-* directory with an owner-only ACL and hard-links the database there before handing SQLite the link. This prevents SQLite from ever resolving the attacker-controlled side-file names.
The vulnerable functions are those that existed before the fix and are directly implicated in the defect: _connect (the Windows branch that connects by path), _open_lock_database and _raise_if_wal (which validate only the database handle, not the side files), and _do_acquire_inner (which lets the resulting sqlite3.OperationalError escape instead of converting it to Timeout). These are the functions that would appear in a runtime profile when the vulnerability is triggered.
_connectsrc/filelock/_read_write.py
_open_lock_databasesrc/filelock/_read_write.py
_raise_if_walsrc/filelock/_read_write.py
_do_acquire_innersrc/filelock/_read_write.py