What is the CVSS score of CVE-2026-35521?

CVE-2026-35521 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Ftl are affected by CVE-2026-35521?

Pi-hole FTL versions 6.0-6.5 contain a remote code execution vulnerability allowing authenticated users to execute arbitrary system commands through DHCP configuration injection, directly…. A patch is available.

How to fix or mitigate CVE-2026-35521?

Within 24 hours: Identify all Pi-hole FTL instances running versions 6.0-6.5 using `pihole -v` or admin dashboard. Within 7 days: Apply vendor-released patch to upgrade all affected instances to version 6.6 or later; restrict DHCP configuration access to essential administrators only. Within 30 days: Audit administrative credential history, implement multi-factor authentication for Pi-hole admin accounts, and monitor dnsmasq configuration logs for suspicious entries.

Ftl CVE-2026-35521

EUVD-2026-19715 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

Command Injection RCE Ftl

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19715

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:20 nvd

HIGH 8.8

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

AnalysisAI

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DHCP hosts configuration parameter. Exploitation requires low-complexity network access with low-level authentication (CVSS 8.8, AV:N/AC:L/PR:L). No public exploit identified at time of analysis, though the vulnerability's straightforward injection mechanism and the popularity of Pi-hole as a DNS/DHCP solution elevate practical risk for environments with multiple administrative users or compromised credentials.

Technical ContextAI

Pi-hole FTL (Faster Than Light DNS) serves as the core DNS and DHCP engine for Pi-hole network-wide ad blocking systems, interfacing directly with dnsmasq for DNS/DHCP services. This vulnerability exploits CWE-78 (OS Command Injection) through insufficient input sanitization in the dhcp.hosts configuration parameter processing. When FTL translates user-supplied DHCP host entries into dnsmasq configuration directives, newline characters are not properly escaped or validated, allowing attackers to break out of the intended configuration context. By injecting newline-delimited dnsmasq directives such as 'dhcp-script=' or 'conf-file=', an authenticated attacker can specify arbitrary shell scripts to be executed with the privileges of the FTL process, which typically runs with elevated system permissions to manage network services. The affected product is specifically cpe:2.3:a:pi-hole:ftl:*:*:*:*:*:*:*:* covering the FTL component rather than the broader Pi-hole web interface.

RemediationAI

Immediately upgrade Pi-hole FTL to version 6.6 or later, which contains input validation fixes that properly sanitize newline characters in the dhcp.hosts configuration parameter. The vendor-released patch in version 6.6 addresses the underlying command injection vulnerability by implementing strict input filtering and escaping mechanisms for DHCP configuration entries. Administrators should access the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c for upgrade instructions and release notes. As a temporary risk mitigation measure for environments unable to immediately patch, restrict administrative access to the Pi-hole interface through network segmentation, implement multi-factor authentication if supported by deployment configuration, audit existing DHCP host entries for suspicious newline characters or unexpected configuration directives, and monitor FTL process execution for anomalous child processes. However, these workarounds do not eliminate the vulnerability and should only serve as interim controls pending upgrade to version 6.6.