StackRadar

CVE-2026-112907

Low

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026
Severity
Low
worst across findings
CVSS
2.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
92
of 18,232 indexed, latest versions
Container images
90
deployed by those charts
Fix available
1 of 1
affected package

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Carried by container images the latest versions of 92 of 18,232 indexed charts deploy, on 90 images.

Affected packageAffected versionsFixed inImages
filelockpypi3.25.0, 3.25.1, 3.25.2, 3.29.0+19 more4.2.190
OSV records
GHSA-567q-5qvw-pf92

Charts affected

92 by stars
ChartLatestAffected imagesRadar Score
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
filelock@3.30.2
4.2.1

Open the chart page →

1,650
certmatecertmateVerified publisher2.52.11 of 1See more

certmate certmate 2.52.1

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
fabriziosalmi/certmate:2.52.12a91ed5946fa
filelock@4.0.8
4.2.1

Open the chart page →

1,270
paperless-ngxcfi20170.1.01 of 3See more

paperless-ngx cfi2017 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
filelock@4.0.12
4.2.1

Open the chart page →

8,896
kitchenowlchart-kitchenowl0.1.131 of 2See more

kitchenowl chart-kitchenowl 0.1.13

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
filelock@3.32.0
4.2.1

Open the chart page →

4,101
paperless-ngxcharts-derwitt-devVerified publisher2.1.101 of 1See more

paperless-ngx charts-derwitt-dev 2.1.10

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
filelock@4.0.12
4.2.1

Open the chart page →

5,588
galaxycloudve6.8.91 of 3See more

galaxy cloudve 6.8.9

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
filelock@3.29.0
4.2.1

Open the chart page →

8,297
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
filelock@3.25.0
4.2.1

Open the chart page →

51,713
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
filelock@3.32.4
4.2.1

Open the chart page →

4,439
home-assistantegebackVerified publisher2.0.371 of 1See more

home-assistant egeback 2.0.37

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1

Open the chart page →

3,860
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
filelock@3.29.0
4.2.1

Open the chart page →

44,480
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latest04eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
filelock@3.32.4
4.2.1

Open the chart page →

4,439
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
filelock@3.32.7
4.2.1

Open the chart page →

2,165
changedetectionhelmforgeVerified publisher1.1.201 of 1See more

changedetection helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
filelock@3.32.0
4.2.1

Open the chart page →

861
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1

Open the chart page →

8,878
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
filelock@3.32.0
4.2.1

Open the chart page →

42,418
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
filelock@3.29.0
4.2.1

Open the chart page →

98,094
librephotosk8sonlabVerified publisher1.2.01 of 7See more

librephotos k8sonlab 1.2.0

1 of the 7 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
reallibrephotos/librephotos:1.4.011418bf5d617
filelock@4.2.0
4.2.1

Open the chart page →

18,628
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
filelock@3.29.0
4.2.1

Open the chart page →

9,546
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
filelock@3.29.0
4.2.1

Open the chart page →

12,704
forkliftkubevirt-forkliftVerified publisher0.4.01 of 2See more

forklift kubevirt-forklift 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
quay.io/kubev2v/forklift-operator:release-2.12c879733fd77e
filelock@3.32.0
4.2.1

Open the chart page →

2,302
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
filelock@3.32.0
4.2.1

Open the chart page →

4,718
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
filelock@3.32.0
4.2.1

Open the chart page →

4,491
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
filelock@3.32.2
4.2.1

Open the chart page →

4,468
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
filelock@4.0.12
4.2.1

Open the chart page →

5,747
libretranslateobeoneVerified publisher1.0.71 of 1See more

libretranslate obeone 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
libretranslate/libretranslate:v1.9.61de2d7056bb8
filelock@3.29.0
4.2.1

Open the chart page →

2,373
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
filelock@3.25.2
4.2.1

Open the chart page →

3,195
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1

Open the chart page →

6,319
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1

Open the chart page →

2,790
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
filelock@3.29.4
4.2.1

Open the chart page →

5,108
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1

Open the chart page →

4,843
wyoming-faster-whisperschoolguys-helmcharts0.1.41 of 1See more

wyoming-faster-whisper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
rhasspy/wyoming-whisper:3.5.0308b7959a925
filelock@3.29.7
4.2.1

Open the chart page →

2,739
wyoming-piperschoolguys-helmcharts0.1.41 of 1See more

wyoming-piper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.3.169b7f797ae3a
filelock@3.29.7
4.2.1

Open the chart page →

2,280
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
filelock@3.25.2
4.2.1

Open the chart page →

6,719
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
filelock@3.32.7
4.2.1

Open the chart page →

38,204
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
filelock@3.25.0
4.2.1

Open the chart page →

6,160
servicexssl-hep1.8.611 of 16See more

servicex ssl-hep 1.8.6

11 of the 16 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_python:v1.8.696805be717ff
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
filelock@3.32.7
4.2.1
sslhep/x509-secrets:v1.8.634e1c87cea8a
filelock@3.29.6
4.2.1

Open the chart page →

72,320
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
filelock@3.29.0
4.2.1

Open the chart page →

4,613
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
filelock@3.29.4
4.2.1

Open the chart page →

1,987
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
zoo-project-druzoo-projectOfficialVerified publisher0.11.01 of 6See more

zoo-project-dru zoo-project 0.11.0

1 of the 6 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1

Open the chart page →

7,055

Container images carrying it

90 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/dgtlmoon/changedetection.io:0.60.9:latest04eaae7915ba
filelock@3.32.7
4.2.1
4
langflowai/langflow:1.12.6:latesta0396e089eb9
filelock@3.32.0
4.2.1
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
filelock@4.0.12
4.2.1
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1
3
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1
2
nacos/nacos-server:latest1c191c30c8cd
filelock@3.32.4
4.2.1
2
ghcr.io/berriai/litellm:1.106.2:main-stable7294b90f868c
filelock@3.32.7
4.2.1
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
filelock@3.29.0
4.2.1
2
ghcr.io/home-assistant/home-assistant:2026.10.2:latest33afb0659d78
filelock@4.2.0
4.2.1
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1
2
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
filelock@4.0.12
4.2.1
2
acryldata/datahub-actions:v1.8.0d9b47e8640ea
filelock@3.32.7
4.2.1
1
agentarea/agentarea-api:0.1.1:latestde166c910ef9
filelock@3.25.1
4.2.1
1
agentarea/agentarea-worker:0.1.1:latestadb761a4d103
filelock@3.25.1
4.2.1
1
aibrix/metadata-service:v0.8.058b915e3708d
filelock@3.32.7
4.2.1
1
airbyte/manifest-server:7.28.2deec511b51c3
filelock@3.32.3
4.2.1
1
aktosecurity/akto-agent-guard-anonymizer:1.2.2212328d85f87
filelock@4.0.8
4.2.1
1
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
filelock@3.29.7
4.2.1
1
aktosecurity/akto-agent-guard-embedder:1.2.26d90b501493b
filelock@3.32.3
4.2.1
1
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
filelock@3.29.0
4.2.1
1
berkeleyskypilot/skypilot:0.14.125577df35586
filelock@4.1.0
4.2.1
1
castai/hibernate:v0.14da62858c8381
filelock@3.30.2
4.2.1
1
dagster/dagster-celery-k8s:1.13.26605d41ae6647
filelock@4.1.0
4.2.1
1
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
filelock@3.32.4
4.2.1
1
esphome/esphome:2026.10.03a32372dfbd6
filelock@4.0.10
4.2.1
1
esphome/esphome:2026.9.14ad55931c018
filelock@3.32.4
4.2.1
1
fabriziosalmi/certmate:2.52.12a91ed5946fa
filelock@4.0.8
4.2.1
1
growthbook/growthbook:5.1.0c8a124f55dca
filelock@3.32.7
4.2.1
1
growthbook/growthbook:latestdca716a7bf47
filelock@3.32.7
4.2.1
1
homeassistant/home-assistant:2026.75a531753cea9
filelock@3.32.0
4.2.1
1
homeassistant/home-assistant:2026.8.0a21689ef0510
filelock@3.32.2
4.2.1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
filelock@3.29.0
4.2.1
1
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
filelock@3.29.0
4.2.1
1
libretranslate/libretranslate:v1.9.61de2d7056bb8
filelock@3.29.0
4.2.1
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
filelock@3.25.2
4.2.1
1
loeken/home-assistant:2026.9.2b1dff5b4c593
filelock@3.32.6
4.2.1
1
maponyacharles/sceptreai:api-0.1.127b37b092130a
filelock@3.32.2
4.2.1
1
mindsdb/mindsdb:latest163011c09299
filelock@3.29.0
4.2.1
1
openebs/rawfile-localpv:v0.15.396fd7987ea79
filelock@3.29.4
4.2.1
1
posit/package-manager:2026.10.0-ubuntu-24.04574ed7ec955f
filelock@4.1.1
4.2.1
1
reallibrephotos/librephotos:1.4.011418bf5d617
filelock@4.2.0
4.2.1
1
redash/redash:26.3.0c5c9148f5c38
filelock@3.25.0
4.2.1
1
rhasspy/wyoming-piper:2.3.169b7f797ae3a
filelock@3.29.7
4.2.1
1
rhasspy/wyoming-piper:2.5.27d39aafac409
filelock@3.32.6
4.2.1
1
rhasspy/wyoming-whisper:3.5.0308b7959a925
filelock@3.29.7
4.2.1
1
signalen/backend:2.50.1826bb090bc4e4
filelock@3.32.7
4.2.1
1
sslhep/servicex_app:v1.8.6c935e123030d
filelock@3.32.7
4.2.1
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
filelock@3.32.7
4.2.1
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
filelock@3.32.7
4.2.1
1
sslhep/servicex_code_gen_python:v1.8.696805be717ff
filelock@3.32.7
4.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.