GitHub Advisoryadvisory · PyPI

GHSA-w8v5-vhqr-4h9v DiskCache has unsafe pickle deserialization

MEDIUM Published 2026-02-11 Modified 2026-02-12 Official page ↗
Aliases
CVE-2025-69872
Ecosystem
PyPI
Packages
diskcache
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-502, CWE-94
Reviewed
2026-02-12

Affected packages

• PyPI diskcache: <= 5.6.3 (no fix yet)

Description

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.

Related

Alias · CVE (1)

  • CVE-2025-69872 DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-94 Improper Control of Generation of Code weakness

References