CVE-2026-25674

score

<0.1

cvss

3.7

epss

0.3%

published

2026-03-03

kev added

—

first seen

2026-10-21

Django < 6.0.3, < 5.2.12, and < 4.2.29 contain a race condition in file-system storage and file-based cache backends caused by concurrent requests affecting temporary umask changes, letting attackers create files with incorrect permissions, exploit requires multi-threaded environment.