StackRadar

CVE-2026-112913

Low

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026
Severity
Low
worst across findings
CVSS
3.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
92
of 18,232 indexed, latest versions
Container images
90
deployed by those charts
Fix available
1 of 1
affected package

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

Carried by container images the latest versions of 92 of 18,232 indexed charts deploy, on 90 images.

Affected packageAffected versionsFixed inImages
filelockpypi3.25.0, 3.25.1, 3.25.2, 3.29.0+19 more4.2.190
OSV records
GHSA-9vhv-jxww-xfm5

Charts affected

92 by stars
ChartLatestAffected imagesRadar Score
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
filelock@3.30.2
4.2.1

Open the chart page →

1,650
certmatecertmateVerified publisher2.52.11 of 1See more

certmate certmate 2.52.1

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
fabriziosalmi/certmate:2.52.12a91ed5946fa
filelock@4.0.8
4.2.1

Open the chart page →

1,270
paperless-ngxcfi20170.1.01 of 3See more

paperless-ngx cfi2017 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
filelock@4.0.12
4.2.1

Open the chart page →

8,896
kitchenowlchart-kitchenowl0.1.131 of 2See more

kitchenowl chart-kitchenowl 0.1.13

1 of the 2 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
filelock@3.32.0
4.2.1

Open the chart page →

4,101
paperless-ngxcharts-derwitt-devVerified publisher2.1.101 of 1See more

paperless-ngx charts-derwitt-dev 2.1.10

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
filelock@4.0.12
4.2.1

Open the chart page →

5,588
galaxycloudve6.8.91 of 3See more

galaxy cloudve 6.8.9

1 of the 3 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
filelock@3.29.0
4.2.1

Open the chart page →

8,297
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
filelock@3.25.0
4.2.1

Open the chart page →

51,713
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
filelock@3.32.4
4.2.1

Open the chart page →

4,439
home-assistantegebackVerified publisher2.0.371 of 1See more

home-assistant egeback 2.0.37

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1

Open the chart page →

3,860
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
filelock@3.29.0
4.2.1

Open the chart page →

44,480
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latest04eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
filelock@3.32.4
4.2.1

Open the chart page →

4,439
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
filelock@3.32.7
4.2.1

Open the chart page →

2,165
changedetectionhelmforgeVerified publisher1.1.201 of 1See more

changedetection helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
filelock@3.32.0
4.2.1

Open the chart page →

861
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1

Open the chart page →

8,878
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
filelock@3.32.0
4.2.1

Open the chart page →

42,418
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
filelock@3.29.0
4.2.1

Open the chart page →

98,094
librephotosk8sonlabVerified publisher1.2.01 of 7See more

librephotos k8sonlab 1.2.0

1 of the 7 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
reallibrephotos/librephotos:1.4.011418bf5d617
filelock@4.2.0
4.2.1

Open the chart page →

18,628
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
filelock@3.29.0
4.2.1

Open the chart page →

9,546
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
filelock@3.29.0
4.2.1

Open the chart page →

12,704
forkliftkubevirt-forkliftVerified publisher0.4.01 of 2See more

forklift kubevirt-forklift 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
quay.io/kubev2v/forklift-operator:release-2.12c879733fd77e
filelock@3.32.0
4.2.1

Open the chart page →

2,302
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
filelock@3.32.0
4.2.1

Open the chart page →

4,718
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
filelock@3.32.0
4.2.1

Open the chart page →

4,491
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
filelock@3.32.2
4.2.1

Open the chart page →

4,468
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
filelock@4.0.12
4.2.1

Open the chart page →

5,747
libretranslateobeoneVerified publisher1.0.71 of 1See more

libretranslate obeone 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
libretranslate/libretranslate:v1.9.61de2d7056bb8
filelock@3.29.0
4.2.1

Open the chart page →

2,373
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
filelock@3.25.2
4.2.1

Open the chart page →

3,195
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1

Open the chart page →

6,319
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1

Open the chart page →

2,790
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
filelock@3.29.4
4.2.1

Open the chart page →

5,108
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1

Open the chart page →

4,843
wyoming-faster-whisperschoolguys-helmcharts0.1.41 of 1See more

wyoming-faster-whisper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
rhasspy/wyoming-whisper:3.5.0308b7959a925
filelock@3.29.7
4.2.1

Open the chart page →

2,739
wyoming-piperschoolguys-helmcharts0.1.41 of 1See more

wyoming-piper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.3.169b7f797ae3a
filelock@3.29.7
4.2.1

Open the chart page →

2,280
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
filelock@3.25.2
4.2.1

Open the chart page →

6,719
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
filelock@3.32.7
4.2.1

Open the chart page →

38,204
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
filelock@3.25.0
4.2.1

Open the chart page →

6,160
servicexssl-hep1.8.611 of 16See more

servicex ssl-hep 1.8.6

11 of the 16 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_python:v1.8.696805be717ff
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
filelock@3.32.7
4.2.1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
filelock@3.32.7
4.2.1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
filelock@3.32.7
4.2.1
sslhep/x509-secrets:v1.8.634e1c87cea8a
filelock@3.29.6
4.2.1

Open the chart page →

72,320
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
filelock@3.29.0
4.2.1

Open the chart page →

4,613
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
filelock@3.29.4
4.2.1

Open the chart page →

1,987
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
zoo-project-druzoo-projectOfficialVerified publisher0.11.01 of 6See more

zoo-project-dru zoo-project 0.11.0

1 of the 6 container images this version deploys carry CVE-2026-112913.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1

Open the chart page →

7,055

Container images carrying it

90 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
filelock@3.32.7
4.2.1
1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
filelock@3.32.7
4.2.1
1
sslhep/x509-secrets:v1.8.634e1c87cea8a
filelock@3.29.6
4.2.1
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
filelock@3.32.0
4.2.1
1
trackerforce/switcher-slack-app:latest410e58e54e09
filelock@4.0.12
4.2.1
1
treskon/portrait-pythonruntime:DEV-latest694c098bcb52
filelock@3.32.3
4.2.1
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
filelock@3.29.4
4.2.1
1
weblate/weblate:2026.10.1.26663a7c8b444
filelock@4.0.12
4.2.1
1
zenmldocker/zenml-server:0.98.06a03880ace49
filelock@4.1.1
4.2.1
1
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
filelock@4.0.12
4.2.1
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
filelock@3.32.7
4.2.1
1
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
filelock@3.32.5
4.2.1
1
ghcr.io/esphome/esphome:latest776a845d5089
filelock@3.32.4
4.2.1
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
filelock@3.32.0
4.2.1
1
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
filelock@4.0.9
4.2.1
1
ghcr.io/guydavis/machinaris:testf77fa53b89cb
filelock@3.32.7
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
filelock@3.25.0
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
filelock@3.32.6
4.2.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
filelock@3.25.0
4.2.1
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
filelock@3.29.0
4.2.1
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
filelock@4.0.12
4.2.1
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
filelock@3.29.0
4.2.1
1
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
filelock@3.29.0
4.2.1
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
filelock@3.29.3
4.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
filelock@3.32.0
4.2.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1
1
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
filelock@3.32.2
4.2.1
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
filelock@3.25.2
4.2.1
1
ghcr.io/zazukoians/qlever-server:v0.10.39f553deb16a5
filelock@4.0.10
4.2.1
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest3fde5f4a0c1d
filelock@3.32.7
4.2.1
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
filelock@3.29.0
4.2.1
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
filelock@3.25.2
4.2.1
1
quay.io/kubev2v/forklift-operator:release-2.12c879733fd77e
filelock@3.32.0
4.2.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.