{"id":"CVE-2025-69872","title":"DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default","summary":"DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94","CWE-502"],"published":"2026-02-11","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69872","references":[{"url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md","label":"cve@mitre.org"},{"url":"https://github.com/grantjenks/python-diskcache","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:3713","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2025-69872","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439059","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69872.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69872"}],"tags":["nvd","osv","pip"],"epss":0.0053,"epssPercentile":0.4355,"ingestedAt":"2026-07-03T18:53:52.201Z","aliases":["GHSA-w8v5-vhqr-4h9v","PYSEC-2026-2447"],"ecosystem":"pip","vendor":"diskcache","product":"diskcache","affected":["diskcache <= 5.6.3"],"slug":"CVE-2025-69872","body":"## Overview\n\nDiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-69872)\n\nAffected packages:\n\n- `diskcache <= 5.6.3`\n\nSource: https://osv.dev/vulnerability/GHSA-w8v5-vhqr-4h9v","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}