{
  "cveId": "CVE-2026-25674",
  "url": "https://patchblox.com/security/cve/CVE-2026-25674",
  "summary": "CVE-2026-25674 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-25674, released March 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-django: An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29",
  "description": "An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread\u0027s temporary \u0060umask\u0060 change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.",
  "published": "2026-03-03T15:16:19Z",
  "severity": "low",
  "cvss": 3.7,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.00373,
  "epssPercentile": 0.3143,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.2.11-150600.3.50.1",
      "fix": "SUSE-SU-2026:0821-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0821-1",
      "released": "2026-03-05T11:43:12Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.6.1",
      "fix": "OPENSUSE-SU-2026:20373-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20373-1",
      "released": "2026-03-17T13:27:11Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.7",
      "fixedVersion": "4.2.11-150600.3.50.1",
      "fix": "SUSE-SU-2026:0821-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0821-1",
      "released": "2026-03-05T11:43:12Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.29-1",
      "fix": "DEBIAN-CVE-2026-25674",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-25674",
      "released": "2026-03-03T15:16:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}