Live › vulnerability › CVE-2026-119334
Pi-hole's gravity.sh checks that a file:// adlist is readable by the pihole user, but curl then opens a different file after URL dot-segment normalization, so a symlink and decoy can make it read a root-only file. An attacker who can add adlists and place files on the filesystem can read files they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Pi-hole installations before 6.5 where administrators can add adlists. Exploitation also requires the ability to place a symlink and decoy file on the filesystem, so a locked-down single-admin setup is much less exposed. Installations already on 6.5 or later are not affected.
No product ranges from the sources yet.
pihole -v and confirm it is below 6.5.6.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119334")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.