CVE-2025-69872
Published: 11 February 2026
Summary
CVE-2025-69872 is a critical-severity Code Injection (CWE-94) vulnerability in Redhat (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked at the 41.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2025-69872 affects DiskCache, a Python library (python-diskcache) through version 5.6.3, which uses Python's pickle module for serialization by default. This insecure deserialization mechanism allows an attacker to craft malicious cache files that lead to arbitrary code execution upon reading by a victim application. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code ('Code Injection')) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
An attacker with write access to the cache directory can exploit this by placing a maliciously serialized pickle payload in the cache. When a legitimate application subsequently reads from the cache directory, it deserializes the payload, resulting in remote code execution on the victim's system. The attack requires no privileges, user interaction, or special conditions beyond directory write access, making it feasible in shared hosting, multi-tenant environments, or misconfigured applications exposing cache storage.
For mitigation details, refer to the disclosure advisory at https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md and the project repository at https://github.com/grantjenks/python-diskcache, which may include patch information or upgrade guidance beyond version 5.6.3.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207391
Vulnerability details
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure pickle deserialization in Python library directly enables arbitrary Python code execution on cache read.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the insecure deserialization flaw in DiskCache through 5.6.3, preventing arbitrary code execution via malicious pickle payloads.
Enforces approved authorizations to restrict write access to the cache directory, blocking attackers from planting malicious serialized payloads.
Mandates secure configuration settings for DiskCache, such as using safe serialization alternatives to the default pickle module, to comprehensively mitigate deserialization risks.