CVE-2026-112910

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1.

• CWE-732

• https://github.com/tox-dev/filelock/commit/72786d41aa25159ad28c1bcf4291738b135b2c6c
• https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
• https://github.com/tox-dev/filelock/pull/835
• https://github.com/tox-dev/filelock/releases/tag/4.2.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112905Vvveb is a powerful and easy to use CMS with page builder to…9
• CVE-2026-112906filelock is a platform-independent file lock for Python. Fro…4.7
• CVE-2026-112907filelock is a platform-independent file lock for Python. Fro…2.5
• CVE-2026-112908filelock is a platform-independent file lock for Python. Fro…5.3
• CVE-2026-112909filelock is a platform-independent file lock for Python. Pri…6.1
• CVE-2026-11291Inappropriate implementation in Android Autofill in Google C…4.3
• CVE-2026-112911filelock is a platform-independent file lock for Python. Fro…6.3
• CVE-2026-112912filelock is a platform-independent file lock for Python. Fro…2.5
• CVE-2026-112913filelock is a platform-independent file lock for Python. Fro…3.3
• CVE-2026-112914filelock is a platform-independent file lock for Python. Fro…5.3
• CVE-2026-112915filelock is a platform-independent file lock for Python. Fro…5.5
• CVE-2026-112917In Docker Desktop for Windows with the WSL2 backend, an unpr…9.2