filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

影響: pip:filelock >= 3.10.0, <= 4.2.0 → 4.2.1

filelock on Windows ignores the mode argument. FileLock(path, mode=0o600) creates the same file as FileLock(path): one with no security descriptor of its own (the Windows record that says who may access a file). Its access list, or ACL, is whatever the lock directory hands down to new files. filelock creates the ReadWriteLock database, which it asks to be 0o600, the same way. In a directory whose inheritable ACL grants other local accounts access to new files, those accounts can open the lock f…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:08, GitHub Advisory Database에서 "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python, Windows. CVE: CVE-2026-112910.