Ftl CVE-2026-35520

Authenticated attacker with access to Pi-hole FTL API or Web interface versions 6.0-6.5. Attacker must modify the dhcp.leaseTime configuration parameter by injecting newline characters to inject arbitrary dnsmasq directives, achieving command execution.

This vulnerability presents significant real-world risk despite requiring authentication. The CVSS 8.8 score accurately reflects the threat severity: network-accessible attack vector (AV:N), low complexity (AC:L), requires only low privileges (PR:L), no user interaction (UI:N), and achieves full system compromise across confidentiality, integrity, and availability (C:H/I:H/A:H). No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at this time. However, the low attack complexity and clear injection vector mean proof-of-concept development would be straightforward for skilled attackers. The requirement for authentication provides some defense-in-depth, but Pi-hole administrative interfaces are commonly exposed on home and small business networks where credential hygiene may be weak. Organizations using Pi-hole in production environments or with internet-exposed management interfaces should treat this as a critical priority for immediate patching. The command injection nature makes this vulnerability automatable once initial access is obtained, and the complete system compromise potential enables lateral movement, data exfiltration, or denial of service scenarios.

An attacker who has obtained or brute-forced credentials for a low-privilege Pi-hole administrative account accesses the web interface from the internet or local network. The attacker navigates to the DHCP settings page and modifies the lease time parameter, injecting newline characters followed by malicious dnsmasq directives such as 'dhcp-script=/tmp/malicious.sh'. When the FTL engine processes this configuration, it writes the injected directives into the dnsmasq configuration file and triggers a configuration reload. The malicious dhcp-script directive causes dnsmasq to execute the attacker's payload script whenever DHCP events occur, granting the attacker persistent code execution with the privileges of the FTL process. From this foothold, the attacker can pivot to compromise the entire Pi-hole system, exfiltrate DNS query logs, modify DNS responses for phishing campaigns, or use the compromised system as a launching point for attacks against other network devices.