What is the CVSS score of CVE-2026-35518?

CVE-2026-35518 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pi Hole are affected by CVE-2026-35518?

Pi-hole FTL versions 6.0-6.5 contain a remote code execution vulnerability allowing authenticated users with low privileges to execute arbitrary system commands through DNS configuration…. A patch is available.

How to fix or mitigate CVE-2026-35518?

Within 24 hours: Identify all Pi-hole FTL deployments and document current versions (SSH or console access: `pihole -v`). Within 7 days: Upgrade all affected instances (versions 6.0-6.5) to the latest patched version released by Pi-hole project; verify upgrade completion with version check command. Within 30 days: Audit DNS configuration change logs for unauthorized modifications and review authentication logs for suspicious low-privilege account activity during the vulnerability window.

Pi Hole CVE-2026-35518

EUVD-2026-19685 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

RCE Command Injection Pi Hole Ftl

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2026-19685

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:17 nvd

HIGH 8.8

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

AnalysisAI

Remote code execution in Pi-hole FTL DNS engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DNS CNAME records parameter (dns.cnameRecords). Authentication requirements confirmed (CVSS PR:L - low privileges required). Publicly available exploit code exists. CVSS 8.8 with network attack vector and low complexity indicates high exploitability once authenticated access is obtained.

Technical ContextAI

FTLDNS (pihole-FTL) is the core DNS resolver and API engine for Pi-hole network-wide ad blocking software. The vulnerability stems from improper neutralization of special elements used in OS commands (CWE-78: OS Command Injection). The dns.cnameRecords configuration parameter passes user-controlled input to dnsmasq, the underlying DNS forwarder, without adequately sanitizing newline characters. An attacker with authenticated access to the Pi-hole administrative interface can inject arbitrary dnsmasq configuration directives by embedding newline-separated commands within CNAME record definitions. Because dnsmasq configuration directives can include dhcp-script and other parameters that execute external programs, this injection vector escalates to full remote code execution with the privileges of the FTL process, typically running as the pihole user or root depending on installation configuration.

RemediationAI

Upgrade Pi-hole FTL to version 6.6 or later, which contains fixes for the command injection vulnerability in dns.cnameRecords processing. Users should run 'pihole -up' or manually update the FTL component following Pi-hole's standard upgrade procedures documented at the project's GitHub repository. As interim mitigation for environments unable to immediately upgrade, restrict administrative interface access to trusted networks only, enforce strong authentication credentials, implement network segmentation to prevent Pi-hole from accessing critical internal systems, and audit existing CNAME record configurations for suspicious entries. Monitor system logs for unexpected dnsmasq restarts or configuration changes. Complete remediation guidance is available in the vendor security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m.