Bug report

The default mimetypes.knownfiles are user-writeable on Windows. Instead of loading from these files the default behavior should be to only load from the registry.

See: https://www.cve.org/CVERecord?id=CVE-2024-3220)

On Windows, Currently users are being recommended to call mimetypes.init([]) on Windows to mitigate the vulnerability.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-159428: Don't read mimetypes.knownfiles by default on Windows #159445
• [3.15] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) #159489
• [3.14] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) #159490
• [3.13] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) #159570
• [3.12] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) #159572
• [3.11] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) #159573