Live › vulnerability › CVE-2026-119335
Pi-hole's shell helper validates the FTL PID file too weakly, so a digit-prefixed arithmetic expression written to it is evaluated by Bash when root-run Pi-hole subcommands read it. An attacker who already runs code as the pihole user can execute commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Only installs of Pi-hole before 6.5 are affected, and only once an attacker already has code execution as the pihole user. Hosts that run Pi-hole as a single-purpose DNS appliance with no other local users have less exposure than shared machines. Installs already on 6.5 or later are not affected.
No product ranges from the sources yet.
pihole -v and compare the Pi-hole version against the fixed release.advanced/Scripts/utils.sh in the Pi-hole install for the getFTLPID function's expr validation line.6.5 or later (per the advisory, fixed in version 6.5).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119335")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.