Read the docs
TI-2024-18806 Aliases CVE-2024-28247

Pihole Authenticated Arbitrary File Read with root privileges

Priority HIGH 68CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Privilege escalation
Confidentiality · integrity · availability
High · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-269.

Summary

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin with "file*" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01414 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pi-holepi-hole> 5.18—No fix listedCNA
  • pi-hole VendorPi-hole Affected > 5.18 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*before 5.18VulnerablePi-hole
  • cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:* Versions before 5.18 Vulnerable ·Pi-hole

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28247

References

Exploit 1

Patch 1

  • TI-2020-07073 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard… KEVCVSS 3.1HIGH 7.2
  • TI-2020-08981 The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload… CVSS 3.1HIGH 8.8
  • TI-2026-36901 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` CVSS 3.1HIGH 8.8
  • TI-2024-22701 Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) CVSS 3.1HIGH 8.8
  • TI-2021-12374 (Authenticated) Remote Code Execution Possible in Web Interface 5.5 CVSS 3.1HIGH 8.8
  • TI-2025-24251 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution CVSS 4.0CRITICAL 9.0
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences