Django Race Condition Vulnerability in File-Based Cache and Storage Backends Allowing Incorrect File Permissions

A race condition vulnerability has been identified in Django versions 6.0 prior to 6.0.3, 5.2 prior to 5.2.12, and 4.2 prior to 4.2.29. This vulnerability arises in the file-system storage and file-based cache backends, where concurrent requests can lead to the creation of file system objects with incorrect permissions. In multi-threaded environments, a temporary change in the 'umask' of one thread can inadvertently affect other threads, allowing for exploitation. Unsupported Django versions, such as 5.0.x, 4.1.x, and 3.2.x, may also be vulnerable.

Impact

Exploitation of this vulnerability can result in file system objects being created with unintended permissions, potentially leading to unauthorized access or modification of those files.

Remediation

Users can upgrade to Django versions 6.0.3, 5.2.12, or 4.2.29 to address this vulnerability.