Vulnerability advisory

CVE-2026-25674

Potential incorrect permissions on newly created file system objects

Published Mar 3, 2026Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2026-25674GHSA-mjgh-79qc-68w3PYSEC-2026-2449

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
36b5f39d9372147f0e758f590e35ee2b2bc317dd to before a0d3bdb5b0a22cdbb4d3f7e5eabd7fe0f7311f68	`a0d3bdb5b0a22cdbb4d3f7e5eabd7fe0f7311f68`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 4f382ca672f86dd4a1e4d071c91d0caad0e124b3	`4f382ca672f86dd4a1e4d071c91d0caad0e124b3`
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before f2ec75efbcf4d1ed63f135e5f8ff5f0463175312	`f2ec75efbcf4d1ed63f135e5f8ff5f0463175312`
Also listed as affected (15) `5.2.11` `6.0.2` `6.0.1` `5.2.10` `6.0` `5.2.9` `5.2.8` `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

CVE-2026-25674

Affected versions

Repository

Description

References