{"id":"CVE-2026-119336","kind":"vulnerability","aliases":["CVE-2026-119336"],"related":[],"title":"Pi-hole: root cron job follows symlinks, letting pihole user truncate root files","description":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.","summary":"Pi-hole versions 6.4.2 up to 6.5 run a root cron job that truncates and chmods /etc/pihole/versions while following symbolic links in a directory the pihole user owns. A local attacker running as the pihole user can use a symlink to truncate or create arbitrary root-owned files, or make a sensitive file world-readable.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","infrastructure","linux","pi-hole","self-hosted"],"not_affected_if":["no-local-pihole-user-access","version-6.5-or-later"],"how_to_check":"- Check the installed Pi-hole version with `pihole -v` and confirm whether it is at least `6.5`.\n- On a Pi-hole host, check whether `/etc/pihole/versions` is a symbolic link or whether its parent directory is writable by the `pihole` user.","fix":"- Pi-hole: move to version `6.5` or later.","status":"open","published_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:30+00:00","updated_at":"2026-10-30T20:26:30+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-30T20:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- Pi-hole: move to version `6.5` or later.","reach":"local","title":"Pi-hole: root cron job follows symlinks, letting pihole user truncate root files","impact":"high","summary":"Pi-hole versions 6.4.2 up to 6.5 run a root cron job that truncates and chmods /etc/pihole/versions while following symbolic links in a directory the pihole user owns. A local attacker running as the pihole user can use a symlink to truncate or create arbitrary root-owned files, or make a sensitive file world-readable.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["pi-hole","self-hosted","linux","dns"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"root-owned files truncated or created, sensitive files made world-readable","analyst_note":"","how_to_check":"- Check the installed Pi-hole version with `pihole -v` and confirm whether it is at least `6.5`.\n- On a Pi-hole host, check whether `/etc/pihole/versions` is a symbolic link or whether its parent directory is writable by the `pihole` user.","plain_action":"","needs_analyst":false,"not_affected_if":["version-6.5-or-later","no-local-pihole-user-access"],"who_is_affected":"Only Pi-hole installs from 6.4.2 up to but not including 6.5 are affected, and the attacker needs to already run code as the pihole user on that machine. Pi-hole servers on a home or business network are the systems to look at, and installs already at 6.5 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4231,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119336':17A,20A '-2026':16A,19A '/etc/pihole/versions':47B,127C '0':122C '6.4.2':34B,109C '6.5':37B,111C,188C '644':125C 'advanced/scripts/updatecheck.sh':116C 'appli':119C 'arbitrari':75B,161C 'attack':61B,141C 'chmod':46B,124C,171C 'client':105C 'client-sid':104C 'content':100C 'creat':74B,159C 'cron':5A,41B,117C 'cve':15A,18A 'devic':97C 'directori':54B,134C 'dns':21B,93C 'execut':142C 'file':14A,79B,84B,165C 'fix':185C 'follow':7A,49B,129C 'hole':3A,26B,32B,90C 'host':29B 'infrastructur':22B 'instal':102C 'issu':183C 'job':6A,42B,118C 'let':9A 'link':51B,131C 'linux':23B 'local':60B 'make':81B,172C 'oper':156C,169C 'own':58B,78B,135C,164C 'path':148C 'pi':2A,25B,31B,89C 'pi-hol':1A,24B,30B,88C 'pihol':10A,56B,65B,138C,144C 'protect':96C 'race':167C 'readabl':87B,178C 'replac':146C 'root':4A,13A,40B,77B,114C,155C,163C 'root-own':76B,162C 'root-run':113C 'run':38B,62B,115C 'schedul':154C 'self':28B 'self-host':27B 'sensit':83B,174C 'side':106C 'sinkhol':94C 'softwar':107C 'symbol':50B,130C 'symlink':8A,70B,151C 'target':175C 'truncat':12A,44B,72B,120C,157C,180C 'unwant':99C 'use':68B 'user':11A,57B,66B,139C 'version':33B,187C 'without':101C,179C 'world':86B,177C 'world-read':85B,176C","nicknames":[],"mitigations":[],"who_affected":"Only Pi-hole installs from 6.4.2 up to but not including 6.5 are affected, and the attacker needs to already run code as the pihole user on that machine. Pi-hole servers on a home or business network are the systems to look at, and installs already at 6.5 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119336","severity":null,"published_at":"2026-10-30T20:17:08+00:00","modified_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}