CVE-2026-119336
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Pi-hole from 6.4.2 until 6.5, the root-run updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker running as pihole can replace the path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race them so chmod makes a sensitive target world-readable.
Risk Assessment
An attacker can corrupt arbitrary system files or expose their contents, potentially leading to privilege escalation or system instability. This requires prior code execution as the pihole user.
Recommendation
Update Pi-hole to version 6.5 or later. Restrict write access to /etc/pihole for the pihole user and monitor for unusual symbolic links.
Other vulnerabilities in Pi-hole
See all- CVE-2026-41489High
Pi-hole, a DNS sinkhole system, has a vulnerability in shell scripts that perform file operations with root privileges without validating paths. An attacker with Pi-hole privileges can exploit this flaw to escalate privileges to root by manipulating SSH keys.
- CVE-2026-119335High
In Pi-hole prior to 6.5, getFTLPID() in utils.sh validates the pihole-owned /run/pihole-FTL.pid file with expr, rejecting only values whose first character is not a digit. An attacker with code execution as pihole can write a digit-prefixed arithmetic expression that Bash then evaluates as root, enabling command substitution execution.
- CVE-2026-119334Low
In Pi-hole prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes.
- CVE-2026-50130High
A vulnerability in Pi-hole versions 6.0 to 6.4.2 allows a user with code execution as the unprivileged pihole user to escalate privileges to root by replacing the /etc/pihole/logrotate file. The file is then processed by pihole-FTL-prestart.sh, which changes its ownership to root:root, and subsequently executed as root by the daily pihole flush cron, enabling arbitrary code execution with administrative privileges.
Original NVD description (English source)
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS