Ftl CVE-2026-35518

Authenticated attacker with access to Pi-hole FTL engine versions 6.0–6.5. Attacker must modify the dns.cnameRecords configuration parameter via the API or Web interface to inject newline characters and arbitrary dnsmasq directives, achieving command execution on the underlying system.

This vulnerability presents elevated real-world risk for internet-exposed Pi-hole instances with weak authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation with low complexity once low-privilege authentication is achieved, resulting in complete system compromise (C:H/I:H/A:H). Publicly available exploit code exists per the GitHub Security Advisory, significantly lowering the skill barrier for exploitation. No EPSS or KEV data provided, but no public exploit identified at time of analysis in CISA's Known Exploited Vulnerabilities catalog. Attack complexity is genuinely low - the vulnerability requires only authenticated API access and a single malformed CNAME record submission. Primary risk factors include: Pi-hole instances accessible from untrusted networks, deployments using default or weak administrative credentials, and environments where Pi-hole runs with elevated privileges. The authentication requirement provides meaningful defense-in-depth, but credential stuffing, brute force, or secondary authentication bypass vulnerabilities could enable exploitation. Organizations running Pi-hole 6.0-6.5 should prioritize remediation, especially for internet-facing or multi-tenant deployments.

An attacker identifies a Pi-hole instance with exposed administrative interface (port 80/443) and obtains valid credentials through credential stuffing, default password exploitation, or social engineering. The attacker authenticates to the Pi-hole web interface, navigates to the DNS CNAME records configuration section, and submits a malicious CNAME entry containing embedded newline characters followed by a dnsmasq dhcp-script directive pointing to an attacker-controlled reverse shell script. When FTL processes this configuration and restarts dnsmasq, the injected directive executes the attacker's payload with pihole user privileges, establishing persistent access to the underlying system. From this foothold, the attacker can pivot to other network resources, exfiltrate DNS query logs containing internal network reconnaissance data, or escalate privileges if the FTL process runs as root.