Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112910— filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

Quick assessment

Affected
tox-dev filelock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

filelock 是一个跨平台的 Python 文件锁库。在 3.10.0 至 4.2.1 版本之间，filelock 在 Windows 平台上会忽略 WindowsFileLock 文件和 ReadWriteLock SQLite 数据库的 mode 参数。当以 mode=0o600 创建锁时，由于 _open_non_reparse_fd 和 _nt_open 函数未创建“仅所有者”的安全描述符，该锁会继承父目录的可继承访问控制列表（ACL）。因此，另一个拥有继承访问权限的本地账户可以读取锁持有者元数据或锁数

CVSS 5.3 · Medium

Possible ATT&CK Techniques 2 AI

T1070.004 · File Deletion T1562.004
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112910

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
Source: CVE Program / CVE List V5
Vulnerability Description
filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tox-dev filelock >= 3.10.0, < 4.2.1 -

II. Public POCs for CVE-2026-112910

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112910

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112910 (1)

Vendor Pages for CVE-2026-112910 (1)

Other References for CVE-2026-112910 (2)

Same Patch Batch · tox-dev · 2026-11-05 · 5 CVEs total

CVE-2026-112938 5.8 MEDIUM filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and cre
CVE-2026-112908 5.3 MEDIUM filelock: StrictSoftFileLock creates its claim directories without the lock mode, so anoth
CVE-2026-112913 3.3 LOW filelock: ReadWriteLock on Windows acts on SQLite side files another local user places bes
CVE-2026-112907 2.5 LOW filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past i

IV. Related Vulnerabilities

Same product: filelock
Same vendor: tox-dev
Same weakness: CWE-732