CVE-2026-113720 is a vulnerability in virtualenv where files copied from a cached app-data directory retain file permissions from an earlier environment, potentially resulting in files with broader access than intended. This occurs because shutil.copy preserves the cached file modes regardless of the current umask. An attacker with access to the new environment can exploit this if the cache was created under permissive permissions and the new environment is accessible to other local accounts. The issue was identified in virtualenv versions starting from 20.0.2 and fixed in version 4.67.0.