Vulnerabilities

Vulnerability · CVE-2026-112910

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · filelock: WindowsFileLock ignores mode:

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-112910. A missing EPSS score is not a low risk. Compare filelock: WindowsFileLock ignores mode: with the linked advisory before you change production.

Severity

Medium5.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Not in the current FIRST EPSS dataset

Remediation

Version ranges on file

Affected products

pip filelock · pypi filelock

filelock on Windows ignores the argument. creates the same file as : one with no security descriptor of its own (the Windows record that says who may access a file). Its access list, or ACL, is whatever the lock directory hands down to new files. filelock creates the database, which it asks to be , the same way. In a directory whose inheritable ACL grants other local accounts access to new files, those accounts can open the lock file or database. They can take the byte-range lock (a lock on a span of bytes in a file) once the owner releases it and keep the owner's later calls waiting or timing out. They can read holder metadata an hook left in a file. Where the directory hands down modify access, they can write to both files. still reports . The documentation neither promises an ACL on Windows nor says that Windows drops the mode. On Unix the same mode keeps other accounts out. Mutual exclusion between processes that follow the protocol holds on either platform. Affected versions are filelock 3.10.0 through 4.2.0 on Windows. Anthropic's OSS Scanner reported this in private. Finding covered by this advisory: - [medium, CWE-732]: WindowsFileLock ignores mode; 0o600 lock files inherit the directory ACL. ## Severity **CVSS 3.1 scores 5.3 (Medium).** (local): the other account needs a logon on the same host. (low privileges): an ordinary account is enough. (no user interaction). (low attack complexity): no race. (partial confidentiality impact): the lock file (holder metadata) and the lock database are readable where was meant to keep them private. (partial integrity impact): in the directory layout the maintainers tested, the other account can also write both files, which lets it corrupt the lock's own state but nothing the lock protects. (partial availability impact): the other account can hold the byte-range lock and make the owner wait or time out. (scope unchanged). Classification from the review: **Windows permission failure with security impact only where callers