Incorrect Permission Assignment for Critical Resource Affecting filelock package, versions [3.10.0,4.2.1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-FILELOCK-21802490
- published29 Oct 2026
- disclosed28 Oct 2026
- creditAnthropic's OSS Scanner
Introduced: 28 Oct 2026
NewCVE-2026-112910 (opens in a new tab)How to fix?
Upgrade filelock to version 4.2.1 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the Windows file lock backend (WindowsFileLock), which ignores the mode parameter when creating lock files. An attacker with local access can observe or interfere with lock files that should have been created with restrictive permissions (e.g. mode=0o600), because the NtCreateFile call is made without a security descriptor regardless of the requested mode, leaving the file with the directory's default ACL instead of an owner-only ACL. This also affects deadline handling and lock file integrity in the affected backends.