CVE-2026-50130

HighCVSS 8.8

Published: 14/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

A vulnerability in Pi-hole versions 6.0 to 6.4.2 allows a user with code execution as the unprivileged pihole user to escalate privileges to root by replacing the /etc/pihole/logrotate file. The file is then processed by pihole-FTL-prestart.sh, which changes its ownership to root:root, and subsequently executed as root by the daily pihole flush cron, enabling arbitrary code execution with administrative privileges.

Risk Assessment

The risk is that an attacker who has already gained limited access to the system as the pihole user can fully compromise the server, obtaining root privileges, which could lead to a breach of data confidentiality, integrity, and availability.

Recommendation

Immediately update Pi-hole to version 6.4.3 or later, which contains a fix for this vulnerability. After updating, it is also recommended to check the integrity of configuration files and system logs for signs of potential exploitation.

Other vulnerabilities in Pi-hole

CVE-2026-41489High
Pi-hole, a DNS sinkhole system, has a vulnerability in shell scripts that perform file operations with root privileges without validating paths. An attacker with Pi-hole privileges can exploit this flaw to escalate privileges to root by manipulating SSH keys.

Original NVD description (English source)

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.