{"id":"UBUNTU-CVE-2026-112910","details":"filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1.","modified":"2026-11-07T01:45:05.667319523Z","published":"2026-11-06T00:00:00Z","upstream":["CVE-2026-112910"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-112910"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-112910"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/72786d41aa25159ad28c1bcf4291738b135b2c6c"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"affected":[{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.11-1","2.0.12-1","2.0.13-1","3.0.0-2","3.0.3-1","3.0.4-1","3.0.4-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.4-1ubuntu0.1~esm1","binary_name":"python-filelock"},{"binary_version":"3.0.4-1ubuntu0.1~esm1","binary_name":"python3-filelock"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-1","3.0.12-2","3.0.12-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.12-2ubuntu0.1~esm1","binary_name":"python3-filelock"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-2","3.3.2-1","3.4.0-1","3.4.2-1","3.4.2-2","3.6.0-1","3.6.0-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.6.0-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.2-1","3.12.4-1","3.13.1-1","3.13.1-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.13.1-1ubuntu0.1~esm1","binary_name":"python3-filelock"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.3-1","3.29.4-1","3.32.0-1","3.32.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.32.2-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1","3.20.0-1","3.20.2-1","3.20.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.20.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112910.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}