From b07ed2a1e445efde54fc64cb8c37e0f4f7fe53e5 Mon Sep 17 00:00:00 2001 From: Natalia <124304+nessita@users.noreply.github.com> Date: Wed, 21 Jan 2026 18:03:20 -0300 Subject: [5.2.x] Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation. This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews. Backport of 019e44f67a8dace67b786e2818938c8691132988 from main. --- django/core/files/storage/filesystem.py | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) (limited to 'django/core/files/storage/filesystem.py') diff --git a/django/core/files/storage/filesystem.py b/django/core/files/storage/filesystem.py index 1bd9aa0a6c..bdb95484e7 100644 --- a/django/core/files/storage/filesystem.py +++ b/django/core/files/storage/filesystem.py @@ -7,7 +7,7 @@ from django.conf import settings from django.core.files import File, locks from django.core.files.move import file_move_safe from django.core.signals import setting_changed -from django.utils._os import safe_join +from django.utils._os import safe_join, safe_makedirs from django.utils.deconstruct import deconstructible from django.utils.deprecation import RemovedInDjango60Warning from django.utils.encoding import filepath_to_uri @@ -87,15 +87,10 @@ class FileSystemStorage(Storage, StorageSettingsMixin): directory = os.path.dirname(full_path) try: if self.directory_permissions_mode is not None: - # Set the umask because os.makedirs() doesn't apply the "mode" + # Workaround because os.makedirs() doesn't apply the "mode" # argument to intermediate-level directories. - old_umask = os.umask(0o777 & ~self.directory_permissions_mode) - try: - os.makedirs( - directory, self.directory_permissions_mode, exist_ok=True - ) - finally: - os.umask(old_umask) + # https://github.com/python/cpython/issues/86533 + safe_makedirs(directory, self.directory_permissions_mode, exist_ok=True) else: os.makedirs(directory, exist_ok=True) except FileExistsError: -- cgit v1.3