CVE-2026-25674: Django Race Condition Vulnerability in File-System Storage and Cache Backends
Summary
CVE-2026-25674: Django has a Race Condition vulnerability. Affects django across 3 version ranges.
>= 4.2, < 4.2.29
>= 5.2, < 5.2.12
>= 6.0, < 6.0.3
Fixed in 4.2.29, 5.2.12 or 6.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-25674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and an admin interface. However, certain versions of Django are susceptible to a race condition vulnerability that affects file-system storage and file-based cache backends, potentially leading to security issues.
Vulnerability Detail
An issue was discovered in Django versions 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. The vulnerability arises from a race condition in the file-system storage and file-based cache backends, allowing an attacker to create file system objects with incorrect permissions through concurrent requests. This occurs when one thread's temporary 'umask' change inadvertently affects other threads in a multi-threaded environment. Unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x may also be affected, posing a risk to applications relying on these versions.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.294.2.29pip install --upgrade "django==4.2.29" -
>= 5.2, < 5.2.125.2.12pip install --upgrade "django==5.2.12" -
>= 6.0, < 6.0.36.0.3pip install --upgrade "django==6.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing a locking mechanism to prevent concurrent access to file-system storage and cache backends until the package can be updated. This can be done using threading locks in Python, for example:
import threading lock = threading.Lock()
with lock: # Your file handling code here
Conclusion
The Django race condition vulnerability (CVE-2026-25674) poses a risk to applications using affected versions of the framework. It is crucial to update to the latest patched versions to mitigate this risk. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for django →
FAQ
A race condition occurs when multiple threads or processes access shared data and try to change it at the same time, leading to unpredictable results.
Django versions 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29 are affected. Unsupported versions like 5.0.x, 4.1.x, and 3.2.x may also be vulnerable.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow an attacker to create files with incorrect permissions, potentially leading to unauthorized access or data leakage.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for django.
