The ReadWriteLock and AsyncReadWriteLock classes in poetry versions >=2.3.2_1 and <2.5.1_1 resolve lock file paths following symlinks and open them with sqlite3.connect() without preventing symlink traversal. This allows a local attacker with write access to the lock directory to cause the victim process to create or lock files at attacker-controlled locations, potentially breaking mutual exclusion and corrupting protected resources. The issue affects Linux, macOS, and Windows 11. A fix is available in version 2.5.1_1.