Local Privilege Escalation in Pi-hole via /etc/pihole/logrotate (CVE-2026-50130)

Pi-hole is a DNS sinkhole that protects devices from unwanted content. From version 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate, which is then parsed as root by the daily pihole flush cron. This issue is fixed in version 6.4.3. Affected versions: - 6.0 - 6.4.2 We recommend updating to: 6.4.3. CVSS 8.8 · our assessment: this_week Reference: https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3 Details: https://vuln.today/cve/CVE-2026-50130