CVE-2020-24583: Incorrect Default Permissions in Django
Summary
CVE-2020-24583: Django Incorrect Default Permissions. Affects django across 3 version ranges.
>= 2.2a1, < 2.2.16
>= 3.0a1, < 3.0.10
>= 3.1a1, < 3.1.1
Fixed in 2.2.16, 3.0.10 or 3.1.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-24583 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a high-level development environment and follows the model-view-controller architectural pattern. Django allows developers to quickly and efficiently create secure and scalable web applications. However, a vulnerability has been discovered in versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).
Vulnerability Detail
The vulnerability, identified as CVE-2020-24583, relates to incorrect default permissions in Django. Specifically, the FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created during the file upload process. Additionally, it was not applied to intermediate-level collected static directories when using the collectstatic management command. This oversight could potentially lead to unauthorized access or modification of uploaded files or collected static files.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2a1, < 2.2.162.2.16pip install --upgrade "django==2.2.16" -
>= 3.0a1, < 3.0.103.0.10pip install --upgrade "django==3.0.10" -
>= 3.1a1, < 3.1.13.1.1pip install --upgrade "django==3.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually set the correct permissions for the intermediate-level directories created during the file upload process and the collected static directories. This can be done by modifying the file system permissions using the appropriate commands or tools for the operating system in use. However, applying the recommended fix by upgrading to the patched versions is the most secure and reliable solution.
Conclusion
In conclusion, the vulnerability CVE-2020-24583 in Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used) allows unauthorized access or modification of uploaded and collected static files. It is crucial to upgrade to the patched versions or apply the recommended workaround to ensure the security of Django web applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web application development by providing a high-level development environment and following the model-view-controller architectural pattern.
The vulnerability could potentially allow unauthorized access or modification of uploaded files or collected static files in Django web applications.
Versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used) are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Django to version 2.2.16, 3.0.10, or 3.1.1, depending on the version being used.
Yes, a temporary workaround is to manually set the correct permissions for the intermediate-level directories created during the file upload process and the collected static directories.
Related vulnerabilities
Recent vulnerabilities recorded for django.
