TI-2026-83380 Aliases CVE-2026-119336

Symlink following in Pi-hole cron job lets local users clobber root files

LOW 36CWE-59Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Pi-hole from 6.4.2 before 6.5 has a symbolic link following flaw in the root-run updatecheck.sh cron job, which applies truncate and chmod to /etc/pihole/versions. A local attacker running as the pihole user can replace that path with a symlink so root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive file world-readable without truncating it. The flaw is tracked as CWE-59 and CWE-61 and requires local access with low privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00247 16th percentileScored 2026-11-07

Fix Fixed pi-hole (pi-hole): 6.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Pi-hole	pi-hole	6.4.2 to before 6.5	6.5	Patch available	CNA

pi-hole VendorPi-hole Affected 6.4.2 to before 6.5 Fixed in 6.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:pi-hole:pi-hole::::::::	—	—	Pi-hole

cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:* Versions — — ·Pi-hole

Remediation

Upgrade Pi-hole to version 6.5 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA pi-hole (pi-hole) Fixed in 6.5

Timeline

2026-10-30 Threatist record created from CVE-2026-119336
2026-10-30 CISA SSVC decision points changed
2026-10-30 Priority changed: MEDIUM → LOW

References

Other 6

TI-2020-07073 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard… KEVCVSS 3.1HIGH 7.2
TI-2020-08981 The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload… CVSS 3.1HIGH 8.8
TI-2026-36901 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` CVSS 3.1HIGH 8.8
TI-2026-32584 Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer CVSS 3.1HIGH 8.8
TI-2026-30076 Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks CVSS 3.1HIGH 8.8
TI-2026-28731 Pi-hole FTL remote code execution via newline injection in dns.interface configuration CVSS 4.0HIGH 8.7

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences