CVE-2020-24584: Django Filesystem Cache Umask Vulnerability
Summary
CVE-2020-24584: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). Affects django across 3 version ranges.
>= 2.2, < 2.2.16
>= 3.0, < 3.0.10
>= 3.1, < 3.1.1
Fixed in 2.2.16, 3.0.10 or 3.1.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-24584 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and features for building web applications. One of its functionalities is the filesystem cache, which allows Django to store cached data on the file system for improved performance. However, prior to versions 2.2.16, 3.0.10, and 3.1.1 (when Python 3.7+ is used), Django had a vulnerability in the intermediate-level directories of the filesystem cache. These directories were created with the system's standard umask instead of the recommended 0o077, potentially exposing sensitive information to unauthorized access.
Vulnerability Detail
The vulnerability in Django's filesystem cache arises from the incorrect umask settings used when creating intermediate-level directories. By using the system's standard umask instead of 0o077, the directories are created with more permissive permissions, allowing other users on the system to potentially access the cached data. This could lead to unauthorized disclosure of sensitive information or manipulation of the cache contents. The vulnerability affects Django versions 2.2 to 2.2.15, 3.0 to 3.0.9, and 3.1 to 3.1.0 when using Python 3.7 or higher.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.162.2.16pip install --upgrade "django==2.2.16" -
>= 3.0, < 3.0.103.0.10pip install --upgrade "django==3.0.10" -
>= 3.1, < 3.1.13.1.1pip install --upgrade "django==3.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually setting the umask to 0o077 before running Django. This can be done by adding the following line of code at the beginning of the Django application's entry point file (e.g., manage.py):
import os
os.umask(0o077)
By explicitly setting the umask to 0o077, the intermediate-level directories of the filesystem cache will be created with the correct permissions, mitigating the vulnerability.
Conclusion
The Django filesystem cache umask vulnerability exposes sensitive data to unauthorized access due to incorrect umask settings. To mitigate this vulnerability, it is crucial to upgrade Django to the fixed versions or apply the temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows other users on the system to potentially access the cached data stored in the intermediate-level directories of Django's filesystem cache. This could lead to unauthorized disclosure of sensitive information or manipulation of the cache contents.
The vulnerability affects Django versions 2.2 to 2.2.15, 3.0 to 3.0.9, and 3.1 to 3.1.0 when using Python 3.7 or higher.
To fix this vulnerability, it is recommended to upgrade Django to version 2.2.16, 3.0.10, or 3.1.1, depending on the version being used. Alternatively, you can apply the temporary workaround by setting the umask to 0o077 before running Django.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
You can find more information about this vulnerability in the Django advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2020-34.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
