Vulnerabilities

TI-2026-83380 CVE-2026-119336

Symlink following in Pi-hole cron job lets local users clobber root files

LOW 36

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00247 Published 2026-10-30 Fixed in 6.5 CWE-59

TI-2026-83379 CVE-2026-119335

Pi-hole local privilege escalation to root via PID file check bypass

HIGH 69

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00228 Published 2026-10-30 Fixed in 6.5 CWE-78

TI-2026-83378 CVE-2026-119334

Pi-hole file:// adlist check can be bypassed to read other files

LOW 12

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.

CVSS 3.1LOW 2.2 Network High privileges No interaction EPSS 0.00343 Published 2026-10-30 Fixed in 6.5 CWE-59

TI-2026-36901 CVE-2026-50130

Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

HIGH 73

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00257 Published 2026-07-14 Fixed in 6.4.3 CWE-282

TI-2026-32584 CVE-2026-44693

Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

HIGH 73

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00293 Published 2026-06-10 Fixed in 6.6.1 CWE-362

TI-2026-30076 CVE-2026-41489

Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks

HIGH 73

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00132 Published 2026-05-11 Fixed in 6.4.2 CWE-15

TI-2026-28731 CVE-2026-39849

Pi-hole FTL remote code execution via newline injection in dns.interface configuration

HIGH 73

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00956 Published 2026-05-05 Fixed in 6.6.1 CWE-93

TI-2026-27638 CVE-2026-35521

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27637 CVE-2026-35520

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27636 CVE-2026-35519

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00547 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27635 CVE-2026-35518

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27634 CVE-2026-35517

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

HIGH 73

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00874 Published 2026-04-07 Fixed in 6.6 CWE-78

TI-2026-27620 CVE-2026-35491

Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration

MEDIUM 60

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00162 Published 2026-04-07 Fixed in 6.6 CWE-863

TI-2026-25802 CVE-2026-33405

Pi-hole has a Stored HTML Injection in queries.js

MEDIUM 55

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00178 Published 2026-04-06 Fixed in 6.5 CWE-79

TI-2026-26106 CVE-2026-33727

Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).

LOW 31

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00224 Published 2026-04-06 Fixed in 6.4.1 CWE-269

TI-2026-25803 CVE-2026-33406

Pi-hole has a Stored HTML attribute injection

MEDIUM 60

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00263 Published 2026-04-06 Fixed in 6.5 CWE-79

TI-2026-25801 CVE-2026-33404

Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard

MEDIUM 60

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0015 Published 2026-04-06 Fixed in 6.5 CWE-79

TI-2026-25800 CVE-2026-33403

Pi-hole has a Reflected XSS / HTML injection in taillog.js

MEDIUM 60

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00195 Published 2026-04-06 Fixed in 6.5 CWE-79

TI-2026-26144 CVE-2026-33765

Pi-hole Web Interface has a Command Injection Vulnerability

MEDIUM 49

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.01303 Published 2026-03-27 Fixed in 6.0 CWE-78

TI-2026-21439 CVE-2026-26953

Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table

LOW 24

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0034 Published 2026-02-19 Fixed in 6.4.1 CWE-116

TI-2026-21438 CVE-2026-26952

Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute

LOW 24

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00279 Published 2026-02-19 Fixed in 6.4.1 CWE-116

TI-2025-36756 CVE-2025-59151

Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection

HIGH 69

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00436 Published 2025-10-27 Fixed in 6.3 CWE-113

TI-2025-33477 CVE-2025-53533

Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page

MEDIUM 56

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00591 Published 2025-10-27 Fixed in 6.3 CWE-79

TI-2025-23822 CVE-2025-32785

Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)

MEDIUM 44

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.0025 Published 2025-10-27 Fixed in 6.3 CWE-79

TI-2025-24251 CVE-2025-34087 · GHSA-j569-xm4x-j2qh

Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

MEDIUM 57

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.07039 Published 2025-07-03 No fix listed CWE-78

Vulnerabilities

Filters