{"id":"CVE-2026-119335","kind":"vulnerability","aliases":["CVE-2026-119335"],"related":[],"title":"Pi-hole: crafted PID file lets a local user run commands as root","description":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr \"${FTL_PID}\" : \"[^[:digit:]]\", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ \"$pid\" -eq \"-1\" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.","summary":"Pi-hole's shell helper validates the FTL PID file too weakly, so a digit-prefixed arithmetic expression written to it is evaluated by Bash when root-run Pi-hole subcommands read it. An attacker who already runs code as the pihole user can execute commands as root.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","pi-hole","root","self-hosted"],"not_affected_if":["no-local-code-execution","pihole-6.5-or-later"],"how_to_check":"- Run `pihole -v` and compare the Pi-hole version against the fixed release.\n- Check `advanced/Scripts/utils.sh` in the Pi-hole install for the `getFTLPID` function's `expr` validation line.","fix":"- Pi-hole `6.5` or later (per the advisory, fixed in version 6.5).","status":"open","published_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:31+00:00","updated_at":"2026-10-30T20:26:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T20:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Pi-hole `6.5` or later (per the advisory, fixed in version 6.5).","reach":"local","title":"Pi-hole: crafted PID file lets a local user run commands as root","impact":"high","summary":"Pi-hole's shell helper validates the FTL PID file too weakly, so a digit-prefixed arithmetic expression written to it is evaluated by Bash when root-run Pi-hole subcommands read it. An attacker who already runs code as the pihole user can execute commands as root.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pi-hole","self-hosted","linux","root"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker gains root by writing a PID file","analyst_note":"Confirm the fixed version and the exact affected range from the NVD entry or the Pi-hole release notes; sources given list only NVD.","how_to_check":"- Run `pihole -v` and compare the Pi-hole version against the fixed release.\n- Check `advanced/Scripts/utils.sh` in the Pi-hole install for the `getFTLPID` function's `expr` validation line.","plain_action":"","needs_analyst":true,"not_affected_if":["pihole-6.5-or-later","no-local-code-execution"],"who_is_affected":"Only installs of Pi-hole before 6.5 are affected, and only once an attacker already has code execution as the pihole user. Hosts that run Pi-hole as a single-purpose DNS appliance with no other local users have less exposure than shared machines. Installs already on 6.5 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4323,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':166C '-119335':17A,20A '-2026':16A,19A,190C '-41489':191C '/run/pihole-ftl.pid':114C '6.5':104C,209C 'advanced/scripts/utils.sh':105C 'alreadi':70B 'arithmet':48B,148C 'array':172C 'attack':68B,134C 'attempt':107C 'bash':56B,168C 'bypass':181C 'caus':167C 'charact':128C 'client':99C 'client-sid':98C 'code':72B,136C 'command':12A,79B,176C 'content':94C,184C 'content-valid':183C 'craft':4A 'cve':15A,18A,189C 'devic':91C 'digit':46B,120C,132C,146C 'digit-prefix':45B,145C 'dns':87C 'eq':165C 'evalu':54B,163C,171C 'execut':78B,137C,175C 'expr':117C 'express':49B,149C 'file':6A,40B,115C,156C,199C 'first':127C 'fix':206C 'ftl':38B,118C 'getftlpid':106C 'hardcod':196C 'helper':35B 'hole':3A,25B,32B,63B,84C 'host':29B 'instal':96C 'intact':202C 'issu':204C 'leav':194C 'let':7A 'linux':21B 'local':9A 'own':113C,154C 'packag':22B 'path':200C 'pi':2A,24B,31B,62B,83C 'pi-hol':1A,23B,30B,61B,82C 'pid':5A,39B,119C,155C,164C,198C 'pid-fil':197C 'pihol':75B,112C,140C,153C,160C 'pihole-own':111C,152C 'portion':186C 'prefix':47B,147C 'prior':102C 'protect':90C,201C 'read':65B 'recurs':170C 'reject':123C 'remedi':192C 'root':14A,26B,59B,81B,158C,179C 'root-run':58B,157C 'run':11A,60B,71B,159C 'self':28B 'self-host':27B 'shell':34B 'side':100C 'sinkhol':88C 'softwar':101C 'subcommand':64B,161C 'subscript':173C 'substitut':177C 'unwant':93C 'user':10A,76B,141C 'valid':36B,109C,185C 'valu':125C 'version':208C 'weak':42B 'whose':126C 'without':95C 'write':143C 'written':50B","nicknames":[],"mitigations":[],"who_affected":"Only installs of Pi-hole before 6.5 are affected, and only once an attacker already has code execution as the pihole user. Hosts that run Pi-hole as a single-purpose DNS appliance with no other local users have less exposure than shared machines. Installs already on 6.5 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119335","severity":null,"published_at":"2026-10-30T20:17:08+00:00","modified_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}