{"id":"AZL-110067","summary":"CVE-2026-112909 affecting package python-filelock 3.20.3-3","details":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","modified":"2026-10-23T14:16:37.313698768Z","published":"2026-10-20T15:17:15Z","upstream":["CVE-2026-112909"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909"}],"affected":[{"package":{"name":"python-filelock","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-filelock"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.20.3-3"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110067.json"}}],"schema_version":"1.9.0"}