CVE-2026-25674

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

f2ec75efbcf4d1ed63f135e5f8ff5f0463175312

Introduced

9e7cc2b628fe8fd3895986af9b7fc9525034c1b0

Fixed

4f382ca672f86dd4a1e4d071c91d0caad0e124b3

Introduced

36b5f39d9372147f0e758f590e35ee2b2bc317dd

Fixed

a0d3bdb5b0a22cdbb4d3f7e5eabd7fe0f7311f68

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.29"
        },
        {
            "introduced": "5.2"
        },
        {
            "fixed": "5.2.12"
        },
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.0.3"
        }
    ]
}

Affected versions

5.*

5.2

5.2.1

5.2.10

5.2.11

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

6.*

6.0

6.0.1

6.0.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25674.json"