CVE-2025-69872: diskcache Code Injection
CVSS: 9.8v3.1CriticalDeferred
AliasesGHSA-w8v5-vhqr-4h9vPYSEC-2026-2447UBUNTU-CVE-2025-69872DEBIAN-CVE-2025-69872CGA-2f7g-75fc-5mrwCGA-3v92-5jh8-m68pCGA-5hfx-hq96-73jfCGA-63xj-fhg9-qxq7CGA-6cgm-pxxw-93g5CGA-6mr9-qqfw-87ggCGA-7723-vwmf-7w5wCGA-8j4g-46jg-hgxjCGA-8vjp-gw9g-42pxCGA-93mq-h4q2-rg93CGA-99r7-hcc8-p8qxCGA-f555-qgp8-vcj9CGA-fwh4-75wq-2qvpCGA-gr7f-m8fm-4w67CGA-hwwj-h5w4-3hfpCGA-jc6j-jhqc-f7f4CGA-jpcc-4chr-qjmjCGA-m4qm-vrm4-7qq4CGA-mxvc-8cp6-ghc9CGA-qr69-pf6p-8g68CGA-r2xm-jxvf-g4gpCGA-rjpm-f4ch-wwc4CGA-v3m4-gj5m-39rrCGA-wmgq-wv2r-mcjvCGA-xfwj-jqmx-q9pmCGA-xmhc-9c22-5cc3CGA-xp7c-rcmm-9746CGA-xq9w-4gxx-4fg6CGA-xxwj-xf85-j84xCGA-r672-6xc4-97p3
Published 11-02-2026Last modified 15-07-2026
Vulnerability summary
CVE-2025-69872 is a critical (CVSS 9.8) Code Injection vulnerability in diskcache. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.1% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.61%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 11-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVSS metrics
6 scores · 6 sources · 2 versionsHigh 7.0Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:PSourcesSingle source
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.6–9.8
- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:LDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.08 pp
From 0.53% on 20-09-2026
20-09-202620-10-2026
EPSS score0.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Chainguard26 products
- kserve-huggingfaceserver-cuda-13.3All versions (No fix recorded)
- lmcache-cuda-12.8All versions (No fix recorded)
- nemo< 2.7.3-r0
- nemo-rl-cuda-13.0-sglangAll versions (No fix recorded)
- nemo-rl-cuda-13.0-vllmAll versions (No fix recorded)
Debian1 product
- diskcacheAll versions (No fix recorded)
PyPI1 product
- diskcache≤ 5.6.3
Ubuntu1 product
- diskcacheAll versions (No fix recorded)
4 vendors · 29 products
References
14 links
- pypi.org/project/diskcachePACKAGE
