StackRadar

CVE-2026-112937

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
18
of 18,232 indexed, latest versions
Container images
19
deployed by those charts
Fix available
1 of 2
affected packages

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

Carried by container images the latest versions of 18 of 18,232 indexed charts deploy, on 19 images.

Affected packageAffected versionsFixed inImages
filelockpypi4.1.0, 4.1.1, 4.2.04.2.112
python-filelockdeb3.0.12-2, 3.9.0-1, 3.13.1-1, 3.18.0-1+deb13u1no fix listed7
OSV records
DEBIAN-CVE-2026-112937GHSA-jqc4-5cvw-7w85UBUNTU-CVE-2026-112937

Charts affected

18 by stars
ChartLatestAffected imagesRadar Score
dagsterdagsterVerified publisher1.13.262 of 5See more

dagster dagster 1.13.26

2 of the 5 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
dagster/dagster-celery-k8s:1.13.26605d41ae6647
filelock@4.1.0
4.2.1
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1

Open the chart page →

4,324
dagster-user-deploymentsdagsterVerified publisher1.13.261 of 1See more

dagster-user-deployments dagster 1.13.26

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1

Open the chart page →

856
zenmlzenml0.98.01 of 1See more

zenml zenml 0.98.0

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.98.06a03880ace49
filelock@4.1.1
4.2.1

Open the chart page →

1,390
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
filelock@4.2.0
4.2.1

Open the chart page →

4,129
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
filelock@4.1.0
4.2.1

Open the chart page →

7,122
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
python-filelock@3.18.0-1+deb13u1
no fix listed

Open the chart page →

11,400
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1

Open the chart page →

5,760
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
filelock@4.2.0
4.2.1

Open the chart page →

3,855
rstudio-pmrstudioVerified publisher0.20.71 of 1See more

rstudio-pm rstudio 0.20.7

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
posit/package-manager:2026.10.0-ubuntu-24.04574ed7ec955f
filelock@4.1.1
4.2.1

Open the chart page →

24,894
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
python-filelock@3.0.12-2
no fix listed

Open the chart page →

103,022
music-assistant-serverandibraeuVerified publisher2.1.71 of 1See more

music-assistant-server andibraeu 2.1.7

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1

Open the chart page →

5,760
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-filelock@3.9.0-1
no fix listed

Open the chart page →

8,183
home-assistantegebackVerified publisher2.0.371 of 1See more

home-assistant egeback 2.0.37

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1

Open the chart page →

3,860
librephotosk8sonlabVerified publisher1.2.01 of 7See more

librephotos k8sonlab 1.2.0

1 of the 7 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
reallibrephotos/librephotos:1.4.011418bf5d617
filelock@4.2.0
4.2.1

Open the chart page →

18,628
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.04 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

4 of the 40 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-filelock@3.13.1-1
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
python-filelock@3.13.1-1
no fix listed
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-filelock@3.13.1-1
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-filelock@3.13.1-1
no fix listed

Open the chart page →

310,523
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1

Open the chart page →

2,790
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1

Open the chart page →

4,843
zoo-project-druzoo-projectOfficialVerified publisher0.11.01 of 6See more

zoo-project-dru zoo-project 0.11.0

1 of the 6 container images this version deploys carry CVE-2026-112937.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1

Open the chart page →

7,055

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1
2
ghcr.io/home-assistant/home-assistant:2026.10.2:latest33afb0659d78
filelock@4.2.0
4.2.1
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1
2
berkeleyskypilot/skypilot:0.14.125577df35586
filelock@4.1.0
4.2.1
1
dagster/dagster-celery-k8s:1.13.26605d41ae6647
filelock@4.1.0
4.2.1
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-filelock@3.9.0-1
no fix listed
1
posit/package-manager:2026.10.0-ubuntu-24.04574ed7ec955f
filelock@4.1.1
4.2.1
1
pretix/standalone:2026.8.0ec17c2f761f7
python-filelock@3.18.0-1+deb13u1
no fix listed
1
reallibrephotos/librephotos:1.4.011418bf5d617
filelock@4.2.0
4.2.1
1
statcan/ckan:2.93921305425b8
python-filelock@3.0.12-2
no fix listed
1
zenmldocker/zenml-server:0.98.06a03880ace49
filelock@4.1.1
4.2.1
1
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-filelock@3.13.1-1
no fix listed
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
python-filelock@3.13.1-1
no fix listed
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-filelock@3.13.1-1
no fix listed
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-filelock@3.13.1-1
no fix listed
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.