What is the CVSS score of CVE-2026-35519?

CVE-2026-35519 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pi Hole are affected by CVE-2026-35519?

Pi-hole FTL versions 6.0-6.5 contain a remote code execution vulnerability allowing authenticated administrators to execute arbitrary system commands through DNS configuration manipulation.. A patch is available.

How to fix or mitigate CVE-2026-35519?

Within 24 hours: Identify all Pi-hole FTL instances in your environment and document current versions. Within 7 days: Apply the vendor-released patch to upgrade all affected instances (6.0-6.5) to the patched version; restrict administrative access to Pi-hole interfaces pending patching. Within 30 days: Conduct access review of Pi-hole administrative accounts and implement multi-factor authentication or IP-based access controls for the web interface.

Pi Hole CVE-2026-35519

EUVD-2026-19711 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

RCE Command Injection Pi Hole Ftl

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19711

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:18 nvd

HIGH 8.8

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

AnalysisAI

Remote code execution in Pi-hole FTL 6.0 through 6.5 allows authenticated attackers to execute arbitrary commands via newline injection in DNS host record configuration. The vulnerability exploits improper input sanitization in the dns.hostRecord parameter, enabling injection of malicious dnsmasq directives that execute at the system level. With CVSS 8.8 (network-accessible, low complexity, requires low-privilege authentication), this represents a critical risk for Pi-hole deployments where administrative access controls are weak. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.

Technical ContextAI

Pi-hole FTL (Faster Than Light DNS) is the core DNS and DHCP engine powering Pi-hole network-wide ad blocking systems. The vulnerability stems from CWE-78 (OS Command Injection) in the DNS host record configuration interface. When authenticated users configure custom DNS host records through the dns.hostRecord parameter, FTL passes these values to the underlying dnsmasq daemon without proper sanitization of newline characters. An attacker can inject newline-delimited dnsmasq configuration directives, including exec statements or conf-file directives pointing to attacker-controlled configuration files. Since dnsmasq runs with elevated privileges to bind to port 53 and manage system DNS, any injected commands execute with the same privilege level as the FTL service. The affected product CPE cpe:2.3:a:pi-hole:ftl:*:*:*:*:*:*:*:* confirms this impacts the FTL component specifically across the 6.0-6.5 version range.

RemediationAI

Upgrade Pi-hole FTL to version 6.6 or later, which contains the complete fix for the newline injection vulnerability in DNS host record configuration. The vendor-released patch is available through standard Pi-hole update mechanisms using 'pihole -up' command or manual installation from the official Pi-hole repository. Organizations unable to immediately upgrade should implement compensating controls including restricting administrative access to the Pi-hole web interface to trusted networks only, enforcing strong authentication credentials for admin accounts, monitoring FTL logs for suspicious dnsmasq configuration changes, and implementing network segmentation to limit the blast radius of potential compromise. Complete remediation guidance and update procedures are documented in the GitHub Security Advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp. No workarounds exist to fully mitigate the vulnerability without upgrading, as the flaw is architectural in the configuration parsing logic.