CVE-2026-25674: Potential incorrect permissions on newly created file system objects
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25674?
CVE-2026-25674 has a medium severity due to the potential for unauthorized file system access.
How do I fix CVE-2026-25674?
To fix CVE-2026-25674, upgrade to Django versions 6.0.3, 5.2.12, or 4.2.29 or later.
Which versions of Django are affected by CVE-2026-25674?
Django versions prior to 6.0.3, 5.2.12, and 4.2.29 are affected by CVE-2026-25674.
What causes CVE-2026-25674 in Django?
CVE-2026-25674 is caused by a race condition in file-system storage and file-based cache backends.
Is CVE-2026-25674 specific to any operating system?
CVE-2026-25674 is not specific to any operating system, as it affects Django's file handling across all platforms.