The ReadWriteLock and AsyncReadWriteLock classes in lexicon versions >=3.23.2_4 and <3.25.2_5 resolve lock file paths by following symlinks and then open them with SQLite without preventing symlink traversal. This allows a local attacker with write access to the lock directory to cause the victim process to create or lock files at unintended locations, potentially breaking mutual exclusion and corrupting protected resources. The issue affects Linux, macOS, and Windows 11. A fix is available in lexicon version 3.25.2_5.