CVE-2018-25111 Details

A vulnerability in Django Helpdesk versions prior to 1.0.0 allows for sensitive data exposure due to the use of 'os.umask(0)' in 'models.py'. This behavior creates directories and files with overly permissive permissions, such as '777' for directories, which can lead to unintended access to confidential files. Although uploaded files default to '644', the initial directory permissions can create a security risk by allowing broad access to attachment files.

Users can update to Django Helpdesk version 1.0.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the project's documentation.