Symlink Vulnerability in Pi-hole DNS Sinkhole Software

CVE-2026-119336

What is CVE-2026-119336?

A security concern has been identified in the Pi-hole DNS sinkhole software, specifically affecting versions from 6.4.2 to 6.5. Due to a flaw in the cron job 'updatecheck.sh', an attacker with pihole user privileges could exploit symbolic links to manipulate file permissions or create other root-owned files. By synergizing actions within the cron job, it is possible to render sensitive locations world-readable, leading to potential unauthorized access. This vulnerability has been addressed in version 6.5, so it is crucial for users to update their installations to maintain network security.

References