CVE-2026-25674

216.73.216.75

· Published 03/03/2026 15:16 · Modified 03/03/2026 21:52

Labels: CVE-2026-25674 2026-03-03 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 CVE-2026-25674 CWE-362

Essential information

Published: 03/03/2026 15:16
Modified: 03/03/2026 21:52
Author: —
Creator: —
CVSS: 3.7 LOW (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS metrics

Description

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

NVD status

Status: Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
NVD: View on NVD

Affected products (CPE)

Product	CPE
django / django	`cpe:2.3:a:django:django:<6.0.3:::::::*`
django / django	`cpe:2.3:a:django:django:<5.2.12:::::::*`
django / django	`cpe:2.3:a:django:django:<4.2.29:::::::*`