Race condition in Django’s file‑system storage and file‑based cache backends can cause newly created objects to be created with weaker permissions. The flaw arises when concurrent requests alter a thread’s temporary umask, affecting other threads and producing files that lack the intended restrictive permissions. The likely impact is that an attacker might read or modify data that should normally be protected, potentially enabling privilege escalation or data leakage. This vulnerability is rooted in CWE-362 (Race Condition) and CWE-367 (Access Control).

This issue affects Django releases prior to 6.0.3, 5.2.12 and 4.2.29. Earlier unsupported series such as 5.0.x, 4.1.x and 3.2.x were not evaluated but may also be impacted.

The CVSS score of 3.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be concurrent requests to a multithreaded Django deployment (e.g., a WSGI server that spawns threads). Successful exploitation would create files with overly permissive modes, allowing other users or processes to read or modify them.