EUVD-2026-44529Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs local low-priv pihole-user code execution (AV:L/PR:L); reliable escalation crosses a privilege boundary to root (S:C) yielding full C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
AnalysisAI
Local privilege escalation in Pi-hole 6.0.0 through 6.4.2 lets an attacker who already has code execution as the unprivileged pihole user become root by overwriting the /etc/pihole/logrotate configuration file. Because pihole-FTL-prestart.sh chowns that file to root:root and the daily flush cron then parses it as root via logrotate, a malicious firstaction shell directive runs as uid 0. This is a CWE-282 improper ownership issue with total technical impact; SSVC lists exploitation as proof-of-concept and it is fixed in 6.4.3, with no CISA KEV listing and a low EPSS of 0.22%.
Technical ContextAI
The flaw lives in Pi-hole's log-management plumbing. logrotate is a standard Linux utility that rotates and compresses log files; its config files support pre/post action hooks (firstaction/lastaction/prerotate/postrotate) whose contents are executed as shell by whatever user invokes logrotate. Pi-hole historically stored its logrotate config at /etc/pihole/logrotate - a directory writable in practice by the pihole service account - rather than the root-owned /etc/logrotate.d/. The root cause (CWE-282, Improper Ownership Management) is that pihole-FTL-prestart.sh explicitly ran chown root:root /etc/pihole/logrotate, laundering an attacker-controlled file into root ownership, after which the @reboot and daily cron entries (which run as root per pihole.cron) invoked logrotate --force /etc/pihole/logrotate, executing any embedded firstaction shell as root. The fix commit (18002bf) relocates the config to root-controlled /etc/logrotate.d/pihole across piholeDebug.sh, piholeLogFlush.sh, pihole.cron, and basic-install.sh, and removes the dangerous chown from the prestart script entirely.
RemediationAI
Vendor-released patch: upgrade Pi-hole to 6.4.3 or later, which moves the logrotate configuration to the root-owned /etc/logrotate.d/pihole and removes the vulnerable chown root:root /etc/pihole/logrotate from pihole-FTL-prestart.sh (see the release at https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3 and advisory https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww). If you cannot upgrade immediately, the concrete compensating controls are: remove or lock down /etc/pihole/logrotate so the pihole user cannot write it (e.g. set the file immutable with chattr +i and root ownership), which prevents the swap but will break Pi-hole's own logrotate updates on the next install/update; and temporarily disable the daily flush/@reboot logrotate cron entry in the pihole cron file so the attacker-controlled config is never parsed as root, at the cost of unrotated, growing Pi-hole logs. Both are stopgaps - patching to 6.4.3 is the durable fix. Since exploitation requires an existing pihole-user foothold, also investigate and close whatever gave that foothold.
Pi-hole versions up to 3.3 contain an authenticated command injection via the domain allowlist functionality. When addin
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. Rated high sever
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated medium severity (CVSS 6.
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static l
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Rated
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Rate
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated high severity (CVSS 8.8)
An issue was discovered in Pi-Hole through 5.0. Rated high severity (CVSS 7.8), this vulnerability is low attack complex
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dash
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side softwa
Local privilege escalation in Pi-hole (Core 6.0 through before 6.4.2, FTL through before 6.6.1) lets a user with pihole
Same weakness CWE-282 – Improper Ownership Management
View allShare
External POC / Exploit Code
Leaving vuln.today