What is the CVSS score of CVE-2026-35517?

CVE-2026-35517 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pi Hole are affected by CVE-2026-35517?

Pi-hole FTL versions 6.0-6.5 contain a remote code execution vulnerability affecting authenticated users with low privileges, enabling attackers to execute arbitrary system commands through DNS…. A patch is available.

How to fix or mitigate CVE-2026-35517?

Within 24 hours: Identify all Pi-hole FTL instances in your environment and document current versions (check /etc/pihole/pihole-FTL.conf or Admin UI). Within 7 days: Upgrade all affected instances (versions 6.0-6.5) to the patched release (version 6.6 or later per vendor advisory). Within 30 days: Audit low-privilege user account access to Pi-hole; implement principle of least privilege for DNS administration roles and enable logging of configuration changes.

Pi Hole CVE-2026-35517

EUVD-2026-19684 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

RCE Command Injection Pi Hole Ftl

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2026-19684

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

AnalysisAI

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers with low privileges to execute arbitrary system commands by injecting newline-delimited dnsmasq configuration directives into the upstream DNS servers parameter (dns.upstreams). The vulnerability requires network access with authentication (CVSS:3.1 PR:L) but has low attack complexity and no user interaction required. No public exploit identified at time of analysis, though technical details are available in the GitHub Security Advisory.

Technical ContextAI

Pi-hole FTL (Faster Than Light DNS) is the core DNS engine and API server for Pi-hole network-wide ad blocking. The vulnerability stems from improper input neutralization (CWE-78: OS Command Injection) in the dns.upstreams configuration parameter processing. When administrators configure upstream DNS servers through the FTL API, the system fails to sanitize newline characters in the input. Since FTL passes this configuration to the underlying dnsmasq DNS forwarder, an attacker can inject additional dnsmasq configuration directives by embedding newline-separated commands. Dnsmasq's configuration format allows directives that can execute external programs (such as dhcp-script or script-arp), enabling attackers to escalate from configuration injection to arbitrary command execution on the host system running Pi-hole. This affects the cpe:2.3:a:pi-hole:ftl product across all 6.x versions prior to the patched release.

RemediationAI

Upgrade Pi-hole FTL to version 6.6 or later immediately to address this vulnerability. The vendor-released patch version 6.6 contains input validation fixes that prevent newline injection in the dns.upstreams parameter. Administrators can update by running the standard Pi-hole update command: 'pihole -up' or by manually updating the FTL component through the package manager on their distribution. Until patching is complete, implement the following temporary mitigations: restrict network access to the Pi-hole admin interface to trusted management networks only using firewall rules, enforce strong authentication credentials and enable two-factor authentication if available through reverse proxy configurations, audit all accounts with administrative access to Pi-hole and revoke unnecessary privileges, and monitor system logs for unexpected dnsmasq configuration changes or suspicious process execution. Review the complete remediation guidance and security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj for additional context on the vulnerability and patch details.