{"id":"ghsa-ghsa-8mx5-7m5m-r77g","seq":2056947,"kind":"advisory","title":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","url":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","permalink":"https://vulnpulse.app/items/ghsa-ghsa-8mx5-7m5m-r77g","summary":"影響: pip:filelock >= 3.10.0, <= 4.2.0 → 4.2.1\nfilelock on Windows ignores the mode argument. FileLock(path, mode=0o600) creates the same file as FileLock(path): one with no security descriptor of its own (the Windows record that says who may access a file). Its access list, or ACL, is whatever the lock directory hands down to new files. filelock creates the ReadWriteLock database, which it asks to be 0o600, the same way. In a directory whose inheritable ACL grants other local accounts access to new files, those accounts can open the lock f…","severity":"medium","techs":["python","windows"],"cves":["CVE-2026-112910"],"tags":["GHSA-8mx5-7m5m-r77g","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:55.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}