CVE-2026-25674: 
Django vulnerability analysis and mitigation

CVE-2026-25674 is a race condition vulnerability in Django's file-system storage and file-based cache backends that allows attackers to cause file system objects to be created with incorrect permissions via concurrent requests. In multi-threaded environments, one thread's temporary umask change can affect other threads, resulting in improperly permissioned files. The vulnerability affects Django 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. It was disclosed on March 3, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) (Red Hat Advisory, Django Security Releases, Red Hat Bugzilla).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-367 (Time-of-check Time-of-use Race Condition). When Django's file-system storage or file-based cache backends create new file system objects, they temporarily modify the process umask to control file permissions. In multi-threaded server environments, this temporary umask change is not thread-safe — a race window exists where another thread creating files concurrently inherits the modified umask, resulting in files being created with unintended (potentially overly permissive) permissions. Exploitation requires network access and high attack complexity, as the attacker must time concurrent requests to win the race condition (Django Security Releases, Red Hat Bugzilla).

Successful exploitation results in file system objects (stored files or cache files) being created with incorrect, potentially overly permissive permissions, leading to a low confidentiality impact. An attacker who can read the file system (e.g., a local user or another process on the same host) may gain unauthorized access to files that should have been restricted. There is no integrity or availability impact, and the scope is unchanged, limiting the blast radius to the affected Django application's file storage and cache directories (Red Hat Advisory, Django Security Releases).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.025% (0.000250), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory, Django Security Releases).

Django has released patched versions addressing this vulnerability: 6.0.3 for the 6.0.x series, 5.2.12 for the 5.2.x series, and 4.2.29 for the 4.2.x series. Users of unsupported series (5.0.x, 4.1.x, 3.2.x) should upgrade to a supported and patched version. As an additional hardening measure, administrators should review and enforce strict OS-level access controls on Django's file storage and cache directories to limit exposure even if incorrect permissions are set. IBM has also issued an advisory for affected EDB Postgres AI Hybrid Management products (Django Security Releases, IBM Advisory, Django 6.0.3 Release Notes).

The Django project credited Tarek Nakkouch for responsibly reporting the issue and published a security advisory alongside the patched releases on March 3, 2026. Red Hat, SUSE, openSUSE, Mageia, Fedora, and Oracle all issued downstream advisories or updates in the weeks following disclosure, indicating broad ecosystem attention. Security news outlets such as SecurityOnline.info covered the release as part of Django's broader March 2026 security patch batch. Community reaction was measured given the low CVSS score and absence of active exploitation (Django Security Releases, Red Hat Advisory).