Read the docs
TI-2026-30076 Aliases CVE-2026-41489

Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks

Priority HIGH 73CWE-15Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1, two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read the files.pid path from this config without validation and use it in privileged file operations (install and rm -f). By writing an arbitrary path into files.pid, an attacker with pihole privilege can cause root to delete and then recreate any file on the system outside the ProtectSystem=full-restricted directories, gaining write access to it. On a default Pi-hole installation this yields local privilege escalation to root via SSH authorized keys manipulation. If /root/.ssh/authorized_keys does not exist (default on fresh installs), only ExecStartPre is required. If the file exists, ExecStopPost deletes it first, and the same restart triggers both hooks in sequence. This vulnerability is fixed in Core 6.4.2 and FTL 6.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Fixed pi-hole (pi-hole): 6.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pi-holepi-hole6.0 to before 6.4.26.4.2Patch availableCNA
  • pi-hole VendorPi-hole Affected 6.0 to before 6.4.2 Fixed in 6.4.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*——Pi-hole
  • cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:* Versions — — ·Pi-hole

Remediation

  • Fix · CNA pi-hole (pi-hole) Fixed in 6.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41489

References

Other 1

  • TI-2020-07073 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard… KEVCVSS 3.1HIGH 7.2
  • TI-2020-08981 The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload… CVSS 3.1HIGH 8.8
  • TI-2026-36901 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` CVSS 3.1HIGH 8.8
  • TI-2026-32584 Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer CVSS 3.1HIGH 8.8
  • TI-2026-28731 Pi-hole FTL remote code execution via newline injection in dns.interface configuration CVSS 4.0HIGH 8.7
  • TI-2026-27638 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection CVSS 3.1HIGH 8.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences