File Lock Vulnerability in Filelock Library Affects Windows Systems

CVE-2026-112910

What is CVE-2026-112910?

The filelock library, a platform-independent file locking mechanism for Python, exhibits a security vulnerability on Windows systems, specifically affecting versions from 3.10.0 to 4.2.1. The issue arises because filelock ignores the mode argument when creating locks with WindowsFileLock or the ReadWriteLock SQLite database. This oversight results in any lock created with mode=0o600 acquiring the parent directory’s inheritable Access Control List (ACL), potentially allowing unauthorized local accounts to read sensitive metadata or alter the lock database. Even though mutual exclusion among processes is maintained, users of this library on Windows need to upgrade to version 4.2.1, where this vulnerability has been effectively addressed.

References