MEDIUM 5.3 GitHub
CVE-2026-112910
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
filelock on Windows ignores the `mode` argument. `FileLock(path, mode=0o600)` creates the same file as `FileLock(path)`: one with no security descriptor of its own (the Windows record that says who may access a file). Its access list, or ACL, is whatever the lock directory hands down to new files. filelock creates the `ReadWriteLock` database, which it asks to be `0o600`, the same way. In a directory whose inheritable ACL grants other local accounts access to new files, those accounts can open t
Affected Products
- pip/filelock >= 3.10.0, <= 4.2.0
References
- https://github.com/advisories/GHSA-8mx5-7m5m-r77g
- https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g
- https://github.com/tox-dev/filelock/pull/835
- https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-28 via GitHub. Affected: pip/filelock >= 3.10.0, <= 4.2.0.
vulnfeed aggregates 17714 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.