CVE-2026-112936

Affected versions of the `filelock` package are vulnerable to Link Following due to passing the resolved lock path to SQLite without rejecting a final symbolic link. `ReadWriteLock` and `AsyncReadWriteLock` resolve the lock path and hand it to SQLite, which follows a symbolic link placed as the last component of that path. A local attacker who can create names in the lock directory can redirect database creation and locking to another file, or split mutual exclusion between two targets so that processes holding what they believe is the same lock are locking different files.