Remote Code Execution Vulnerability in Pi-hole FTL Engine

CVE-2026-35521

What is CVE-2026-35521?

The FTL engine of Pi-hole, from versions 6.0 through before 6.6, is susceptible to a Remote Code Execution (RCE) vulnerability that enables authenticated attackers to exploit the DHCP hosts configuration parameter. By injecting arbitrary dnsmasq configuration directives using newline characters, malicious users can achieve command execution on the underlying system. This threat highlights the importance of maintaining updated software environments to mitigate potential exploits. An update to version 6.6 resolves this issue, reinforcing the need for users to ensure they operate the latest version for secure functionality.

References