What is the CVSS score of EUVD-2026-19713?

EUVD-2026-19713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pi Hole are affected by EUVD-2026-19713?

Pi-hole FTL engine versions 6.0-6.5 contain a remote code execution vulnerability in the DHCP lease time configuration parameter that allows authenticated users to execute arbitrary commands on…. A patch is available.

How to fix or mitigate EUVD-2026-19713?

Within 24 hours: identify all Pi-hole FTL instances running versions 6.0-6.5 in your environment and document network exposure. Within 7 days: apply vendor-released patch to upgrade FTL engine to version 6.6 or later and verify successful deployment. Within 30 days: audit DHCP configuration history logs for suspicious lease time parameter modifications and review access controls to restrict DHCP settings to administrative accounts only.

Pi Hole EUVD-2026-19713

| CVE-2026-35520 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

RCE Command Injection Pi Hole Ftl

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19713

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:19 nvd

HIGH 8.8

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

AnalysisAI

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to inject arbitrary dnsmasq configuration directives via newline character injection in the DHCP lease time parameter (dhcp.leaseTime), leading to command execution on the underlying system. Affects the FTLDNS component that provides Pi-hole's interactive API and web statistics. No public exploit identified at time of analysis, though exploitation requires only low-complexity attack methods with network access and low-privilege authentication (CVSS 8.8).

Technical ContextAI

Pi-hole FTL (Faster Than Light DNS) is the core engine powering Pi-hole's DNS and DHCP services, providing telemetry and configuration management. This vulnerability exploits insufficient input validation in the DHCP lease time configuration parameter, classified as CWE-78 (OS Command Injection). The attack leverages newline character injection to break out of the intended configuration context and inject arbitrary dnsmasq configuration directives. Since dnsmasq configuration files support various directives that can execute external programs (such as dhcp-script or dhcp-luascript options), an attacker can craft malicious input that ultimately results in arbitrary command execution with the privileges of the FTL process. The vulnerability exists in the configuration parsing layer where user-supplied DHCP lease time values are incorporated into dnsmasq configuration without proper sanitization of control characters.

RemediationAI

Upgrade Pi-hole FTL to version 6.6 or later, which contains fixes for the newline injection vulnerability in DHCP lease time configuration parsing. The vendor-released patch is available through standard Pi-hole update mechanisms or can be obtained directly from the Pi-hole GitHub repository. Follow the official update procedure documented at the vendor advisory https://github.com/pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj. As an interim mitigation if immediate patching is not feasible, restrict access to the Pi-hole administrative interface to trusted networks only using firewall rules, disable remote administrative access, and audit user accounts with DHCP configuration permissions. Review DHCP configuration for any suspicious entries that may indicate prior exploitation. After upgrading, verify the installed version is 6.6 or higher using the Pi-hole administrative interface or command-line tools.