Local Privilege Escalation in Pi-hole DNS Sinkhole by Pi-hole Developers

CVE-2026-41489

What is CVE-2026-41489?

A local privilege escalation vulnerability exists in Pi-hole versions prior to Core 6.4.2 and FTL 6.6.1. This issue arises from two shell scripts, pihole-FTL-prestart.sh and pihole-FTL-poststop.sh, which are executed with root privileges by systemd. These scripts read the files.pid path from an unvalidated configuration, enabling an attacker with Pi-hole privileges to manipulate files on the system. By injecting arbitrary paths into files.pid, the attacker can target files outside restricted directories, thereby gaining root access and potentially compromising the system. This vulnerability facilitates unauthorized SSH access via manipulation of the authorized_keys file, with significant security implications for systems running Pi-hole.

References