DNS Sinkhole Product Vulnerability in Pi-hole by Pi-hole

CVE-2026-119334

What is CVE-2026-119334?

Pi-hole is a DNS sinkhole designed to block unwanted content without needing client-side software installations. An identified flaw prior to version 6.5 involves the gravity.sh script's check for adlist file readability, which is inadequately handled. It employs 'sudo -u pihole test -r' for verification but fails to secure the use of 'curl', allowing it to run with elevated privileges, and potentially access restricted files. This misconfiguration permits a deceptive file to pass readability checks while allowing root-level file access through curl commands. An attacker, typically an administrator, must exploit this issue by adding malicious adlists and leveraging symlinks in the filesystem, leading to potential information exposure or system misconfigurations. The vulnerability has been addressed in version 6.5 of Pi-hole.

References