critical9.8
CVE-2025-69872
DiskCache has unsafe pickle deserialization
Impact
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | diskcache | <= 5.6.3 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| DiskCache (Python-Diskcache) | through 5.6.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md
- https://github.com/grantjenks/python-diskcache
- https://access.redhat.com/errata/RHSA-2026:36350
- https://access.redhat.com/errata/RHSA-2026:3713
- https://access.redhat.com/security/cve/CVE-2025-69872
- https://bugzilla.redhat.com/show_bug.cgi?id=2439059
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69872.json
- https://github.com/advisories/GHSA-w8v5-vhqr-4h9v
- https://nvd.nist.gov/vuln/detail/CVE-2025-69872