PT-2026-7636 · Diskcache · Diskcache

Published 2025-01-01 · Updated 2026-03-24 · CVE-2025-69872

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DiskCache (python-diskcache) versions through 5.6.3

Description DiskCache (python-diskcache) through version 5.6.3 utilizes Python pickle for serialization by default. An attacker who has write access to the cache directory can execute arbitrary code when a victim application reads data from the cache. The issue stems from the use of Python pickle, which is susceptible to insecure deserialization.

Recommendations Versions prior to 5.6.4 should be updated.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2025-69872

GHSA-W8V5-VHQR-4H9V

Affected Products

Diskcache

References · 19

• 🔥 https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-69872 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69872 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69872 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8v5-vhqr-4h9v · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69872 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69872 · Vendor Advisory
• https://github.com/grantjenks/python-diskcache · Note
• https://reddit.com/r/VulnMatter/comments/1r3ozdd/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3pq3j/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3pptr/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3ppbt/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://twitter.com/threatcluster/status/2036322220029419870 · Twitter Post