CVE-2026-25674
Potential incorrect permissions on newly created file system objectsAn issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
We have discovered 7 live websites that are affected by CVE-2026-25674.
Affected Software
| Product |  Django |
| Category | Web Application Frameworks |
| Vulnerable Domains | 7 live websites (4.52% of Django install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 2 versions ( 29% of all versions) |
Common Weakness Enumeration
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Details
- Published - Mar 3, 2026
- Updated - Mar 3, 2026
Credits
- Tarek Nakkouch (reporter)
- Natalia Bidart (remediation developer)
- Natalia Bidart (coordinator)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2026-25674 United States | 5 websites |
 Germany | 1 websites |
 Iran | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2026-25674| .com | 4 websites |
| .net | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-25674
Top websites that are affected by CVE-2026-25674. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***********.com | United States | ***,*** | |
| *********.com | Germany | **,***,*** | |
| *******.com | United States | **,***,*** | |
| *********.com | United States | **,***,*** | |
| **********.world | United States | **,***,*** | |
| ***********.ir | Iran | **,***,*** | |
| ***********.net | United States | ***,***,*** |
FAQ
CVE-2026-25674 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Django
A total of 7 websites have been identified as vulnerable to CVE-2026-25674, based on global website indexing conducted by WebTechSurvey.
The Django is affected by the CVE-2026-25674 vulnerability.
Django versions up to 6.0.3 are vulnerable to CVE-2026-25674.
CVE-2026-25674 is resolved in version 6.0.3 of Django.