The vulnerability CVE-2025-69872 affects DiskCache (python-diskcache) through version 5.6.3. The default use of Python's pickle serialization allows an attacker with write access to the cache directory to execute arbitrary code when the victim application deserializes the malicious cache content. This is a critical remote code execution vulnerability with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is related to unsafe deserialization (CWE-502) and code injection (CWE-94). Red Hat has issued security advisories for this vulnerability, indicating vendor acknowledgment and likely remediation efforts.

An attacker who can write to the cache directory can execute arbitrary code in the context of the application reading from the cache. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability is exploitable remotely without privileges or user interaction, making it highly severe.

Red Hat has published security advisories for CVE-2025-69872. Users should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-69872 and the errata RHSA-2026:3713 for official remediation guidance. Since no explicit patch version is provided in the input, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict write access to the cache directory to trusted users only to mitigate exploitation risk.