Which versions of PHP are affected by EUVD-2026-16781?

Pi-hole Admin Interface versions before 6.0 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands with root privileges on affected…. A patch is available.

How to fix or mitigate EUVD-2026-16781?

Within 24 hours: Identify all Pi-hole Admin Interface deployments and document current versions. Within 7 days: Upgrade all Pi-hole instances to version 6.0 or later; if immediate upgrade is impossible, restrict network access to the Admin Interface to trusted IP addresses only via firewall rules. Within 30 days: Verify successful patch deployment across all instances and review access logs for signs of exploitation attempts.

PHP EUVD-2026-16781

Q: What is the CVSS score of EUVD-2026-16781?

EUVD-2026-16781 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-33765 HIGH

OS Command Injection (CWE-78)

2026-03-27 security-advisories@github.com

PHP Command Injection

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:12 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0

EUVD ID Assigned

Mar 27, 2026 - 20:22 euvd

EUVD-2026-16781

Analysis Generated

Mar 27, 2026 - 20:22 vuln.today

CVE Published

Mar 27, 2026 - 20:16 nvd

HIGH 8.9

DescriptionGitHub Advisory

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an attacker can append arbitrary system commands to the intended pihole command. Furthermore, because the command is executed with sudo privileges, the injected commands will run with elevated (likely root) privileges. Version 6.0 patches the issue.

AnalysisAI

Remote code execution with root privileges in Pi-hole Admin Interface versions prior to 6.0 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability stems from unsanitized user input in the 'webtheme' parameter being concatenated directly into sudo-privileged exec() calls in savesettings.php. With CVSS 8.9 (Critical), network-accessible attack vector, and low complexity, this represents a severe compromise risk for Pi-hole deployments exposed to untrusted networks. Proof-of-concept code exists (CVSS E:P metric indicates exploitation proof available).

Technical ContextAI

Pi-hole is a DNS-based network-wide ad blocking solution that runs as a lightweight service on Linux systems. The vulnerability (CWE-78: OS Command Injection) exists in the PHP-based administrative web interface, specifically in savesettings.php. This file processes user-supplied configuration data through POST requests. The vulnerable code path takes the $_POST['webtheme'] parameter and directly concatenates it into a system command string passed to PHP's exec() function, which is wrapped with sudo for privilege elevation. Without input sanitization, validation, or parameterization, attackers can inject shell metacharacters (semicolons, pipes, backticks) to break out of the intended command context and execute arbitrary code. Since the parent process runs with sudo privileges, injected commands inherit root-level access to the underlying operating system, enabling complete system compromise.

RemediationAI

Immediately upgrade Pi-hole Admin Interface to version 6.0 or later, which contains patches eliminating the command injection vulnerability through proper input validation and sanitization. Administrators should update using Pi-hole's standard update mechanism (pihole -up command) or by manually pulling the latest web interface code from the official repository. Until patching is complete, implement defense-in-depth controls: restrict web interface access through firewall rules to trusted IP ranges only, disable external internet access to the admin interface (typically port 80/443), or place Pi-hole behind a VPN or jump host for administrative access. Do not expose the admin interface to untrusted networks or the public internet. Verify successful upgrade by checking the version in the web interface footer or via pihole -v command. Review system logs for suspicious command execution patterns in Apache/lighttpd access logs and system audit logs to identify potential compromise prior to patching. Consult the official vendor advisory at https://github.com/pi-hole/web/security/advisories/GHSA-828h-5x96-rqx7 for additional mitigation guidance.