Skip to main content

Pi Hole

40 CVEs product

Monthly

CVE-2026-50130 Jul 14, 22:17 HIGH PATCH This Week

Local privilege escalation in Pi-hole 6.0.0 through 6.4.2 lets an attacker who already has code execution as the unprivileged pihole user become root by overwriting the /etc/pihole/logrotate configuration file. Because pihole-FTL-prestart.sh chowns that file to root:root and the daily flush cron then parses it as root via logrotate, a malicious firstaction shell directive runs as uid 0. This is a CWE-282 improper ownership issue with total technical impact; SSVC lists exploitation as proof-of-concept and it is fixed in 6.4.3, with no CISA KEV listing and a low EPSS of 0.22%.

RCE Pi Hole
NVD GitHub VulDB
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-44693 Jun 10, 22:11 HIGH This Week

Session hijacking in Pi-hole FTL versions prior to 6.6.1 stems from a race condition in the CivetWeb-based HTTP session management subsystem introduced during the v6.0 rewrite. Remote attackers can leverage concurrent requests to compromise web admin session state, potentially gaining high-impact access (C:H/I:H/A:H per CVSS 8.8) to the DNS sinkhole and network filtering controls. No public exploit identified at time of analysis, but vendor has published an upstream fix in v6.6.1.

Information Disclosure Race Condition Pi Hole Ftl
NVD GitHub VulDB
CVSS 3.1
8.8
EPSS
0.0%
CVE-2026-41489 May 11, 20:21 HIGH PATCH This Week

Local privilege escalation in Pi-hole (Core 6.0 through before 6.4.2, FTL through before 6.6.1) lets a user with pihole privileges gain root by injecting an arbitrary path into the unvalidated files.pid config value, which root-run systemd hooks (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) use in privileged install and rm -f operations. On a default install this enables root-level write access via SSH authorized_keys manipulation. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.01%).

Privilege Escalation Pi Hole
NVD GitHub VulDB
CVSS 3.1
8.8
EPSS
0.0%
CVE-2026-39849 May 05, 21:16 HIGH PATCH This Week

Remote command execution in Pi-hole FTL versions before 6.6.1 allows network-adjacent attackers with API access to inject malicious dnsmasq directives via unvalidated newline characters in the dns.interface configuration field, achieving arbitrary code execution when DHCP leases are requested. Deployments with no admin password (a documented default configuration) expose the configuration API without authentication, enabling unauthenticated remote exploitation. The Pi-hole project released version 6.6.1 with input validation that strips newline characters, and the fix commit (0c46e4ec7f) replaced validate_stub with validate_str_no_newline.

RCE Pi Hole Ftldns
NVD GitHub VulDB
CVSS 4.0
8.7
EPSS
0.1%
CVE-2026-35521 Apr 07, 15:20 HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DHCP hosts configuration parameter. Exploitation requires low-complexity network access with low-level authentication (CVSS 8.8, AV:N/AC:L/PR:L). No public exploit identified at time of analysis, though the vulnerability's straightforward injection mechanism and the popularity of Pi-hole as a DNS/DHCP solution elevate practical risk for environments with multiple administrative users or compromised credentials.

RCE Command Injection Pi Hole Ftl
NVD GitHub
CVSS 3.1
8.8
EPSS
0.3%
CVE-2026-35520 Apr 07, 15:19 HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to inject arbitrary dnsmasq configuration directives via newline character injection in the DHCP lease time parameter (dhcp.leaseTime), leading to command execution on the underlying system. Affects the FTLDNS component that provides Pi-hole's interactive API and web statistics. No public exploit identified at time of analysis, though exploitation requires only low-complexity attack methods with network access and low-privilege authentication (CVSS 8.8).

RCE Command Injection Pi Hole Ftl
NVD GitHub
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-35519 Apr 07, 15:18 HIGH PATCH This Week

Remote code execution in Pi-hole FTL 6.0 through 6.5 allows authenticated attackers to execute arbitrary commands via newline injection in DNS host record configuration. The vulnerability exploits improper input sanitization in the dns.hostRecord parameter, enabling injection of malicious dnsmasq directives that execute at the system level. With CVSS 8.8 (network-accessible, low complexity, requires low-privilege authentication), this represents a critical risk for Pi-hole deployments where administrative access controls are weak. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.

RCE Command Injection Pi Hole Ftl
NVD GitHub
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-35518 Apr 07, 15:17 HIGH PATCH This Week

Remote code execution in Pi-hole FTL DNS engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DNS CNAME records parameter (dns.cnameRecords). Authentication requirements confirmed (CVSS PR:L - low privileges required). Publicly available exploit code exists. CVSS 8.8 with network attack vector and low complexity indicates high exploitability once authenticated access is obtained.

RCE Command Injection Pi Hole Ftl
NVD GitHub
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-35517 Apr 07, 15:16 HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers with low privileges to execute arbitrary system commands by injecting newline-delimited dnsmasq configuration directives into the upstream DNS servers parameter (dns.upstreams). The vulnerability requires network access with authentication (CVSS:3.1 PR:L) but has low attack complexity and no user interaction required. No public exploit identified at time of analysis, though technical details are available in the GitHub Security Advisory.

RCE Command Injection Pi Hole Ftl
NVD GitHub
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-33765 Mar 27, 20:16 HIGH PATCH This Week

Remote code execution with root privileges in Pi-hole Admin Interface versions prior to 6.0 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability stems from unsanitized user input in the 'webtheme' parameter being concatenated directly into sudo-privileged exec() calls in savesettings.php. With CVSS 8.9 (Critical), network-accessible attack vector, and low complexity, this represents a severe compromise risk for Pi-hole deployments exposed to untrusted networks. Proof-of-concept code exists (CVSS E:P metric indicates exploitation proof available).

PHP Command Injection Pi Hole Web Interface
NVD GitHub
CVSS 4.0
8.9
EPSS
0.6%
CVE-2025-34087 Jul 03, 20:15 HIGH POC THREAT Act Now

Pi-hole versions up to 3.3 contain an authenticated command injection via the domain allowlist functionality. When adding a domain, the domain parameter is passed to OS commands without sanitization, allowing administrators to execute arbitrary commands with the Pi-hole daemon's privileges.

Command Injection Pi Hole
NVD GitHub
CVSS 3.1
8.8
EPSS
46.7%
Threat
4.7
CVE-2021-29449 Apr 14, 22:15 MEDIUM POC THREAT This Month

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.4%.

Privilege Escalation Pi Hole
NVD GitHub VulDB
CVSS 3.1
6.3
EPSS
11.4%
CVE-2020-8816 May 29, 19:15 HIGH POC KEV PATCH THREAT Act Now

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

RCE Command Injection Pi Hole
NVD GitHub Exploit-DB
CVSS 3.1
7.2
EPSS
78.2%
CVE-2020-11108 May 11, 15:15 HIGH POC THREAT Act Now

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

PHP RCE File Upload Pi Hole
NVD GitHub Exploit-DB
CVSS 3.1
8.8
EPSS
78.3%
CVE-2026-35491 Apr 07, 15:00 MEDIUM PATCH This Month

Pi-hole FTL versions 6.0 through 6.5 allow authenticated local users with CLI API session privileges to bypass authorization controls and overwrite configuration settings via Teleporter archive imports. The vulnerability exists because the /api/teleporter endpoint incorrectly permits CLI-scoped sessions (intended to be read-only) to execute privileged Teleporter operations, while the /api/config endpoint correctly enforces restrictions. This authentication bypass is fixed in Pi-hole FTL 6.6.

Authentication Bypass Pi Hole Ftl
NVD GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2026-33405 Apr 06, 15:23 LOW PATCH Monitor

Stored HTML injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows authenticated high-privilege users to inject unescaped HTML into query log details via the formatInfo() function, affecting the upstream, client IP, and error description fields. JavaScript execution is mitigated by Content Security Policy, limiting the practical impact to HTML-based attacks such as DOM manipulation or phishing content injection. The vulnerability is fixed in version 6.5.

XSS Pi Hole Web
NVD GitHub
CVSS 3.1
3.1
EPSS
0.0%
CVE-2026-33406 Apr 06, 15:17 MEDIUM PATCH This Month

Stored cross-site scripting (XSS) via HTML attribute injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated remote attackers to perform UI redressing and information disclosure by injecting double quotes into configuration values displayed in settings-advanced.js, exploitable through malicious teleporter backup imports that bypass server-side field validation.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
5.4
EPSS
0.0%
CVE-2026-33404 Apr 06, 15:17 LOW PATCH Monitor

Pi-hole Admin Interface versions 6.0 through 6.4 fail to escape client hostnames and IP addresses from the FTL database when rendering them into the DOM in the Network page and Dashboard chart tooltips, enabling stored cross-site scripting (XSS) attacks. An authenticated admin with high privileges can inject malicious scripts that execute in the context of other administrators' browsers, though the attack requires initial compromise of a DHCP/DNS client hostname field and circumvention of upstream validation in dnsmasq and FTL. This vulnerability is fixed in version 6.5, and no public exploit code or active exploitation has been identified at the time of analysis.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
3.4
EPSS
0.0%
CVE-2026-33403 Apr 06, 15:17 MEDIUM PATCH This Month

Reflected DOM-based XSS in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated attackers to inject arbitrary HTML via a crafted malicious URL targeting the file parameter in taillog.js, potentially enabling credential exfiltration through injected form elements due to a missing form-action Content-Security-Policy directive; fixed in version 6.5.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
6.1
EPSS
0.1%
CVE-2026-33727 Apr 06, 15:02 MEDIUM PATCH This Month

Pi-hole 6.4 allows local privilege escalation to root code execution via insecure sourcing of attacker-controlled content in /etc/pihole/versions by root-run scripts. A compromised low-privilege pihole account can inject malicious code that executes with root privileges, despite the pihole account using nologin shell. This vulnerability is fixed in version 6.4.1.

Privilege Escalation RCE Pi Hole
NVD GitHub
CVSS 3.1
6.4
EPSS
0.0%
CVE-2026-26953 Feb 19, 23:16 MEDIUM POC PATCH This Month

Stored HTML injection in Pi-hole Admin Interface versions 6.0+ allows authenticated attackers to inject arbitrary HTML into the active sessions table via the X-Forwarded-For header, which is unsafely rendered when administrators view the API settings page. Public exploit code exists for this vulnerability, affecting administrators who manage Pi-hole instances. An attacker with valid credentials can exploit this to perform client-side attacks against other administrators viewing the compromised session data.

Python Jquery Pi Hole Web Interface
NVD GitHub
CVSS 3.1
5.4
EPSS
0.1%
CVE-2026-26952 Feb 19, 23:16 MEDIUM PATCH This Month

Pi-hole Admin Interface versions 6.4 and below allow authenticated administrators to inject stored HTML code through improperly sanitized DNS record inputs, enabling persistent attacks visible to any user viewing the DNS records table. The vulnerability exists in the populateDataTable() function which fails to escape special characters in user-supplied data before inserting it into HTML attributes. An attacker with admin privileges can inject malicious code that executes each time the DNS records page is accessed.

DNS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
5.4
EPSS
0.0%
CVE-2024-44069 Aug 19, 02:15 HIGH POC This Week

Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP Authentication Bypass Pi Hole
NVD GitHub
CVSS 3.1
7.5
EPSS
0.5%
CVE-2024-34361 Jul 05, 19:15 HIGH POC PATCH This Week

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

SSRF Pi Hole
NVD GitHub
CVSS 3.1
8.8
EPSS
2.8%
CVE-2024-28247 Mar 27, 19:15 MEDIUM POC PATCH This Month

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Information Disclosure Pi Hole
NVD GitHub
CVSS 3.1
6.5
EPSS
1.4%
CVE-2023-23614 Jan 26, 21:18 HIGH POC This Week

Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Path Traversal Pi Hole Web Interface
NVD GitHub
CVSS 3.1
8.8
EPSS
1.0%
CVE-2022-23513 Dec 23, 00:15 MEDIUM POC THREAT This Month

Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP Authentication Bypass Pi Hole Adminlte
NVD GitHub Exploit-DB
CVSS 3.1
5.3
EPSS
40.2%
CVE-2022-31029 Jul 07, 22:15 MEDIUM PATCH This Month

AdminLTE is a Pi-hole Dashboard for stats and configuration. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Pi Hole Adminlte
NVD GitHub
CVSS 3.1
4.8
EPSS
0.4%
CVE-2021-41175 Oct 26, 14:15 MEDIUM POC PATCH This Month

Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
5.4
EPSS
0.9%
CVE-2021-3812 Sep 17, 07:15 MEDIUM POC PATCH This Month

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
6.1
EPSS
0.5%
CVE-2021-3811 Sep 17, 07:15 MEDIUM POC PATCH This Month

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
CVSS 3.1
6.1
EPSS
0.5%
CVE-2021-3706 Sep 15, 07:15 HIGH POC PATCH This Week

adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Pi Hole Web Interface
NVD GitHub
CVSS 3.1
7.5
EPSS
1.1%
CVE-2021-32793 Aug 04, 18:15 MEDIUM POC This Month

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

XSS Pi Hole
NVD GitHub
CVSS 3.1
4.8
EPSS
0.8%
CVE-2021-32706 Aug 04, 18:15 HIGH POC THREAT This Week

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection Pi Hole
NVD GitHub
CVSS 3.1
8.8
EPSS
60.2%
CVE-2021-29448 Apr 15, 16:15 HIGH POC This Week

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Pi Hole Web Interface Ftldns
NVD GitHub
CVSS 3.1
8.8
EPSS
0.7%
CVE-2020-35659 Dec 24, 16:15 MEDIUM PATCH This Month

The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Pi Hole
NVD GitHub
CVSS 3.1
6.1
EPSS
0.9%
CVE-2020-14162 Jul 30, 14:15 HIGH POC This Week

An issue was discovered in Pi-Hole through 5.0. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Command Injection Pi Hole
NVD
CVSS 3.1
7.8
EPSS
0.6%
CVE-2020-12620 Jul 30, 14:15 HIGH POC This Week

Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Command Injection Pi Hole
NVD GitHub
CVSS 3.1
7.8
EPSS
1.5%
CVE-2020-14971 Jun 23, 14:15 HIGH PATCH This Week

Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

PHP Authentication Bypass Pi Hole
NVD GitHub
CVSS 3.1
7.8
EPSS
0.6%
CVE-2019-13051 Oct 09, 12:15 HIGH PATCH This Week

Pi-Hole 4.3 allows Command Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.

Command Injection Pi Hole
NVD GitHub
CVSS 3.1
8.8
EPSS
12.5%
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Local privilege escalation in Pi-hole 6.0.0 through 6.4.2 lets an attacker who already has code execution as the unprivileged pihole user become root by overwriting the /etc/pihole/logrotate configuration file. Because pihole-FTL-prestart.sh chowns that file to root:root and the daily flush cron then parses it as root via logrotate, a malicious firstaction shell directive runs as uid 0. This is a CWE-282 improper ownership issue with total technical impact; SSVC lists exploitation as proof-of-concept and it is fixed in 6.4.3, with no CISA KEV listing and a low EPSS of 0.22%.

RCE Pi Hole
NVD GitHub VulDB
EPSS 0% CVSS 8.8
HIGH This Week

Session hijacking in Pi-hole FTL versions prior to 6.6.1 stems from a race condition in the CivetWeb-based HTTP session management subsystem introduced during the v6.0 rewrite. Remote attackers can leverage concurrent requests to compromise web admin session state, potentially gaining high-impact access (C:H/I:H/A:H per CVSS 8.8) to the DNS sinkhole and network filtering controls. No public exploit identified at time of analysis, but vendor has published an upstream fix in v6.6.1.

Information Disclosure Race Condition Pi Hole +1
NVD GitHub VulDB
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Local privilege escalation in Pi-hole (Core 6.0 through before 6.4.2, FTL through before 6.6.1) lets a user with pihole privileges gain root by injecting an arbitrary path into the unvalidated files.pid config value, which root-run systemd hooks (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) use in privileged install and rm -f operations. On a default install this enables root-level write access via SSH authorized_keys manipulation. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.01%).

Privilege Escalation Pi Hole
NVD GitHub VulDB
EPSS 0% CVSS 8.7
HIGH PATCH This Week

Remote command execution in Pi-hole FTL versions before 6.6.1 allows network-adjacent attackers with API access to inject malicious dnsmasq directives via unvalidated newline characters in the dns.interface configuration field, achieving arbitrary code execution when DHCP leases are requested. Deployments with no admin password (a documented default configuration) expose the configuration API without authentication, enabling unauthenticated remote exploitation. The Pi-hole project released version 6.6.1 with input validation that strips newline characters, and the fix commit (0c46e4ec7f) replaced validate_stub with validate_str_no_newline.

RCE Pi Hole Ftldns
NVD GitHub VulDB
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DHCP hosts configuration parameter. Exploitation requires low-complexity network access with low-level authentication (CVSS 8.8, AV:N/AC:L/PR:L). No public exploit identified at time of analysis, though the vulnerability's straightforward injection mechanism and the popularity of Pi-hole as a DNS/DHCP solution elevate practical risk for environments with multiple administrative users or compromised credentials.

RCE Command Injection Pi Hole +1
NVD GitHub
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers to inject arbitrary dnsmasq configuration directives via newline character injection in the DHCP lease time parameter (dhcp.leaseTime), leading to command execution on the underlying system. Affects the FTLDNS component that provides Pi-hole's interactive API and web statistics. No public exploit identified at time of analysis, though exploitation requires only low-complexity attack methods with network access and low-privilege authentication (CVSS 8.8).

RCE Command Injection Pi Hole +1
NVD GitHub
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Remote code execution in Pi-hole FTL 6.0 through 6.5 allows authenticated attackers to execute arbitrary commands via newline injection in DNS host record configuration. The vulnerability exploits improper input sanitization in the dns.hostRecord parameter, enabling injection of malicious dnsmasq directives that execute at the system level. With CVSS 8.8 (network-accessible, low complexity, requires low-privilege authentication), this represents a critical risk for Pi-hole deployments where administrative access controls are weak. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.

RCE Command Injection Pi Hole +1
NVD GitHub
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Remote code execution in Pi-hole FTL DNS engine versions 6.0 through 6.5 allows authenticated attackers to execute arbitrary system commands by injecting malicious dnsmasq configuration directives through newline characters in the DNS CNAME records parameter (dns.cnameRecords). Authentication requirements confirmed (CVSS PR:L - low privileges required). Publicly available exploit code exists. CVSS 8.8 with network attack vector and low complexity indicates high exploitability once authenticated access is obtained.

RCE Command Injection Pi Hole +1
NVD GitHub
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Remote code execution in Pi-hole FTL engine versions 6.0 through 6.5 allows authenticated attackers with low privileges to execute arbitrary system commands by injecting newline-delimited dnsmasq configuration directives into the upstream DNS servers parameter (dns.upstreams). The vulnerability requires network access with authentication (CVSS:3.1 PR:L) but has low attack complexity and no user interaction required. No public exploit identified at time of analysis, though technical details are available in the GitHub Security Advisory.

RCE Command Injection Pi Hole +1
NVD GitHub
EPSS 1% CVSS 8.9
HIGH PATCH This Week

Remote code execution with root privileges in Pi-hole Admin Interface versions prior to 6.0 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability stems from unsanitized user input in the 'webtheme' parameter being concatenated directly into sudo-privileged exec() calls in savesettings.php. With CVSS 8.9 (Critical), network-accessible attack vector, and low complexity, this represents a severe compromise risk for Pi-hole deployments exposed to untrusted networks. Proof-of-concept code exists (CVSS E:P metric indicates exploitation proof available).

PHP Command Injection Pi Hole +1
NVD GitHub
EPSS 47% 4.7 CVSS 8.8
HIGH POC THREAT Act Now

Pi-hole versions up to 3.3 contain an authenticated command injection via the domain allowlist functionality. When adding a domain, the domain parameter is passed to OS commands without sanitization, allowing administrators to execute arbitrary commands with the Pi-hole daemon's privileges.

Command Injection Pi Hole
NVD GitHub
EPSS 11% CVSS 6.3
MEDIUM POC THREAT This Month

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.4%.

Privilege Escalation Pi Hole
NVD GitHub VulDB
EPSS 78% CVSS 7.2
HIGH POC KEV PATCH THREAT Act Now

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

RCE Command Injection Pi Hole
NVD GitHub Exploit-DB
EPSS 78% CVSS 8.8
HIGH POC THREAT Act Now

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

PHP RCE File Upload +1
NVD GitHub Exploit-DB
EPSS 0% CVSS 6.1
MEDIUM PATCH This Month

Pi-hole FTL versions 6.0 through 6.5 allow authenticated local users with CLI API session privileges to bypass authorization controls and overwrite configuration settings via Teleporter archive imports. The vulnerability exists because the /api/teleporter endpoint incorrectly permits CLI-scoped sessions (intended to be read-only) to execute privileged Teleporter operations, while the /api/config endpoint correctly enforces restrictions. This authentication bypass is fixed in Pi-hole FTL 6.6.

Authentication Bypass Pi Hole Ftl
NVD GitHub
EPSS 0% CVSS 3.1
LOW PATCH Monitor

Stored HTML injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows authenticated high-privilege users to inject unescaped HTML into query log details via the formatInfo() function, affecting the upstream, client IP, and error description fields. JavaScript execution is mitigated by Content Security Policy, limiting the practical impact to HTML-based attacks such as DOM manipulation or phishing content injection. The vulnerability is fixed in version 6.5.

XSS Pi Hole Web
NVD GitHub
EPSS 0% CVSS 5.4
MEDIUM PATCH This Month

Stored cross-site scripting (XSS) via HTML attribute injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated remote attackers to perform UI redressing and information disclosure by injecting double quotes into configuration values displayed in settings-advanced.js, exploitable through malicious teleporter backup imports that bypass server-side field validation.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 0% CVSS 3.4
LOW PATCH Monitor

Pi-hole Admin Interface versions 6.0 through 6.4 fail to escape client hostnames and IP addresses from the FTL database when rendering them into the DOM in the Network page and Dashboard chart tooltips, enabling stored cross-site scripting (XSS) attacks. An authenticated admin with high privileges can inject malicious scripts that execute in the context of other administrators' browsers, though the attack requires initial compromise of a DHCP/DNS client hostname field and circumvention of upstream validation in dnsmasq and FTL. This vulnerability is fixed in version 6.5, and no public exploit code or active exploitation has been identified at the time of analysis.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 0% CVSS 6.1
MEDIUM PATCH This Month

Reflected DOM-based XSS in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated attackers to inject arbitrary HTML via a crafted malicious URL targeting the file parameter in taillog.js, potentially enabling credential exfiltration through injected form elements due to a missing form-action Content-Security-Policy directive; fixed in version 6.5.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 0% CVSS 6.4
MEDIUM PATCH This Month

Pi-hole 6.4 allows local privilege escalation to root code execution via insecure sourcing of attacker-controlled content in /etc/pihole/versions by root-run scripts. A compromised low-privilege pihole account can inject malicious code that executes with root privileges, despite the pihole account using nologin shell. This vulnerability is fixed in version 6.4.1.

Privilege Escalation RCE Pi Hole
NVD GitHub
EPSS 0% CVSS 5.4
MEDIUM POC PATCH This Month

Stored HTML injection in Pi-hole Admin Interface versions 6.0+ allows authenticated attackers to inject arbitrary HTML into the active sessions table via the X-Forwarded-For header, which is unsafely rendered when administrators view the API settings page. Public exploit code exists for this vulnerability, affecting administrators who manage Pi-hole instances. An attacker with valid credentials can exploit this to perform client-side attacks against other administrators viewing the compromised session data.

Python Jquery Pi Hole +1
NVD GitHub
EPSS 0% CVSS 5.4
MEDIUM PATCH This Month

Pi-hole Admin Interface versions 6.4 and below allow authenticated administrators to inject stored HTML code through improperly sanitized DNS record inputs, enabling persistent attacks visible to any user viewing the DNS records table. The vulnerability exists in the populateDataTable() function which fails to escape special characters in user-supplied data before inserting it into HTML attributes. An attacker with admin privileges can inject malicious code that executes each time the DNS records page is accessed.

DNS Pi Hole Web Interface
NVD GitHub
EPSS 0% CVSS 7.5
HIGH POC This Week

Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP Authentication Bypass Pi Hole
NVD GitHub
EPSS 3% CVSS 8.8
HIGH POC PATCH This Week

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

SSRF Pi Hole
NVD GitHub
EPSS 1% CVSS 6.5
MEDIUM POC PATCH This Month

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Information Disclosure Pi Hole
NVD GitHub
EPSS 1% CVSS 8.8
HIGH POC This Week

Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Path Traversal Pi Hole Web Interface
NVD GitHub
EPSS 40% CVSS 5.3
MEDIUM POC THREAT This Month

Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP Authentication Bypass Pi Hole +1
NVD GitHub Exploit-DB
EPSS 0% CVSS 4.8
MEDIUM PATCH This Month

AdminLTE is a Pi-hole Dashboard for stats and configuration. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Pi Hole Adminlte
NVD GitHub
EPSS 1% CVSS 5.4
MEDIUM POC PATCH This Month

Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 1% CVSS 6.1
MEDIUM POC PATCH This Month

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 1% CVSS 6.1
MEDIUM POC PATCH This Month

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Pi Hole Web Interface
NVD GitHub
EPSS 1% CVSS 7.5
HIGH POC PATCH This Week

adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Pi Hole Web Interface
NVD GitHub
EPSS 1% CVSS 4.8
MEDIUM POC This Month

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

XSS Pi Hole
NVD GitHub
EPSS 60% CVSS 8.8
HIGH POC THREAT This Week

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection Pi Hole
NVD GitHub
EPSS 1% CVSS 8.8
HIGH POC This Week

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Pi Hole Web Interface +1
NVD GitHub
EPSS 1% CVSS 6.1
MEDIUM PATCH This Month

The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Pi Hole
NVD GitHub
EPSS 1% CVSS 7.8
HIGH POC This Week

An issue was discovered in Pi-Hole through 5.0. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Command Injection Pi Hole
NVD
EPSS 2% CVSS 7.8
HIGH POC This Week

Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Command Injection Pi Hole
NVD GitHub
EPSS 1% CVSS 7.8
HIGH PATCH This Week

Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

PHP Authentication Bypass Pi Hole
NVD GitHub
EPSS 12% CVSS 8.8
HIGH PATCH This Week

Pi-Hole 4.3 allows Command Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.

Command Injection Pi Hole
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy