---
id: "CVE-2026-119335"
kind: "vulnerability"
aliases: ["CVE-2026-119335"]
title: "Pi-hole: crafted PID file lets a local user run commands as root"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "package", "pi-hole", "root", "self-hosted"]
not_affected_if: ["no-local-code-execution", "pihole-6.5-or-later"]
published_at: "2026-10-30T20:17:08+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119335", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# Pi-hole: crafted PID file lets a local user run commands as root

Pi-hole's shell helper validates the FTL PID file too weakly, so a digit-prefixed arithmetic expression written to it is evaluated by Bash when root-run Pi-hole subcommands read it. An attacker who already runs code as the pihole user can execute commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pihole -v` and compare the Pi-hole version against the fixed release.
- Check `advanced/Scripts/utils.sh` in the Pi-hole install for the `getFTLPID` function's `expr` validation line.

## Fix

- Pi-hole `6.5` or later (per the advisory, fixed in version 6.5).

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119335

## From the sources

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_