Live › vulnerability › CVE-2026-119336
Pi-hole versions 6.4.2 up to 6.5 run a root cron job that truncates and chmods /etc/pihole/versions while following symbolic links in a directory the pihole user owns. A local attacker running as the pihole user can use a symlink to truncate or create arbitrary root-owned files, or make a sensitive file world-readable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Only Pi-hole installs from 6.4.2 up to but not including 6.5 are affected, and the attacker needs to already run code as the pihole user on that machine. Pi-hole servers on a home or business network are the systems to look at, and installs already at 6.5 or later are not affected.
No product ranges from the sources yet.
pihole -v and confirm whether it is at least 6.5./etc/pihole/versions is a symbolic link or whether its parent directory is writable by the pihole user.6.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119336")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.