Code Execution Vulnerability in Pi-hole DNS Sinkhole by Pi-hole Team

CVE-2026-119335

What is CVE-2026-119335?

Pi-hole, a popular DNS sinkhole solution, has a vulnerability that allows an attacker with code execution permissions as the pi-hole user to exploit the /run/pihole-FTL.pid file. The issue arises from the method used to validate input, which only rejects non-digit prefixed inputs, enabling the crafting of digit-prefixed arithmetic expressions. This could lead to Bash executing unintended commands with root privileges, compromising system security. This vulnerability highlights the importance of proper input validation and was addressed in version 6.5.

References