Fixed #31983 -- Added system check for file system caches location.

Thanks Johannes Maron and Nick Pope for reviews.

1 files changed, 10 insertions, 0 deletions

diff --git a/docs/topics/cache.txt b/docs/topics/cache.txt
index f8e86ae85f..14a257b1f4 100644
--- a/docs/topics/cache.txt
+++ b/docs/topics/cache.txt
@@ -293,6 +293,16 @@ above example, if your server runs as the user ``apache``, make sure the
 directory ``/var/tmp/django_cache`` exists and is readable and writable by the
 user ``apache``.
 
+.. warning::
+
+    When the cache :setting:`LOCATION <CACHES-LOCATION>` is contained within
+    :setting:`MEDIA_ROOT`, :setting:`STATIC_ROOT`, or
+    :setting:`STATICFILES_FINDERS`, sensitive data may be exposed.
+
+    An attacker who gains access to the cache file can not only falsify HTML
+    content, which your site will trust, but also remotely execute arbitrary
+    code, as the data is serialized using :mod:`pickle`.
+
 .. _local-memory-caching:
 
 Local-memory caching