CVE-2026-25674: Django Race Condition Vulnerability in File System Storage
Summary
CVE-2026-25674: Django has a Race Condition vulnerability. Affects django across 3 version ranges.
>= 4.2, < 4.2.29
>= 5.2, < 5.2.12
>= 6.0, < 6.0.3
Fixed in 4.2.29, 5.2.12 or 6.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-25674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to a race condition that can lead to incorrect file permissions in multi-threaded environments.
Vulnerability Detail
A race condition exists in the file-system storage and file-based cache backends of Django versions 4.2 before 4.2.29, 5.2 before 5.2.12, and 6.0 before 6.0.3. This vulnerability allows an attacker to exploit concurrent requests, where a temporary change in one thread's umask can inadvertently affect other threads. As a result, file system objects may be created with incorrect permissions, potentially leading to unauthorized access or manipulation of sensitive files.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.294.2.29pip install --upgrade "django==4.2.29" -
>= 5.2, < 5.2.125.2.12pip install --upgrade "django==5.2.12" -
>= 6.0, < 6.0.36.0.3pip install --upgrade "django==6.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider switching to a single-threaded environment or using a different file storage backend that does not exhibit this race condition until you can update to a patched version.
Conclusion
The Django race condition vulnerability (CVE-2026-25674) poses a significant risk in multi-threaded environments, allowing attackers to create file system objects with incorrect permissions. It is crucial to update to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for django →
FAQ
Django versions 4.2 before 4.2.29, 5.2 before 5.2.12, and 6.0 before 6.0.3 are affected. Unsupported versions like 5.0.x, 4.1.x, and 3.2.x may also be vulnerable.
A race condition occurs when multiple threads or processes access shared resources concurrently, leading to unpredictable behavior and potential security vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to files, allowing attackers to manipulate or read sensitive information.
Yes, you can temporarily switch to a single-threaded environment or use a different file storage backend until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for django.
