What is the CVSS score of CVE-2026-33727?

CVE-2026-33727 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33727?

Yes, a patch is available for CVE-2026-33727. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-33727

EUVD-2026-19291 MEDIUM

Improper Privilege Management (CWE-269)

2026-04-06 GitHub_M

Privilege Escalation RCE Pi Hole

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.4.1

EUVD ID Assigned

Apr 06, 2026 - 15:30 euvd

EUVD-2026-19291

Analysis Generated

Apr 06, 2026 - 15:30 vuln.today

CVE Published

Apr 06, 2026 - 15:02 nvd

MEDIUM 6.4

DescriptionGitHub Advisory

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct interactive-login issue. However, nologin does not prevent code from running as UID pihole if a Pi-hole component is compromised. In that realistic post-compromise scenario, attacker-controlled content in /etc/pihole/versions is sourced by root-run Pi-hole scripts, leading to root code execution. This vulnerability is fixed in 6.4.1.

AnalysisAI

Pi-hole 6.4 allows local privilege escalation to root code execution via insecure sourcing of attacker-controlled content in /etc/pihole/versions by root-run scripts. A compromised low-privilege pihole account can inject malicious code that executes with root privileges, despite the pihole account using nologin shell. This vulnerability is fixed in version 6.4.1.

Technical ContextAI

Pi-hole is a DNS-based ad-blocking service running on Linux systems. The vulnerability stems from CWE-269 (Improper Access Control) where root-privileged Pi-hole scripts source configuration or version data from /etc/pihole/versions without proper validation. The pihole account, though configured with nologin to prevent direct interactive login, can still execute code if a Pi-hole component is compromised (e.g., via a separate vulnerability in the web dashboard or FTL daemon). When root-run scripts then source attacker-modified files from /etc/pihole/versions, the injected code executes with root privileges. This pattern is a classic privilege escalation chain: initial compromise of the pihole account (which has legitimate process execution capabilities) followed by code injection into files trusted by root-level processes.

RemediationAI

Upgrade to Pi-hole version 6.4.1 or later, which fixes the insecure sourcing of version information. The vendor-released patch corrects the privilege escalation by implementing proper input validation and file ownership/permission controls for files sourced by root-run scripts. Administrators should apply the patch immediately to all Pi-hole 6.4 installations. Additional hardening steps include: verify that /etc/pihole/versions and related configuration files are owned by root with restricted write permissions (not writable by the pihole account), and review the Pi-hole security advisory at https://github.com/pi-hole/pi-hole/security/advisories/GHSA-c935-8g63-qp74 for detailed technical context and any interim mitigations if upgrading is delayed.