HIGH🇵🇱 Wersja polska

CVE-2026-50130

CVSS 8.8v3.1pub. 2026-07-14upd. 2026-07-30

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Pi Hole

    APP
    Pi-Hole
    6.0 – 6.4.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2025-34087CRITICAL9.0PL ✓same product

Command Injection w Pi-hole do wersji 3.3 — nieautoryzowane wykonanie poleceń OS

CVE-2020-8816HIGH7.2⚠ KEVsame product

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHC...

CVE-2024-44069HIGH7.5same product

Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of th...

CVE-2024-34361HIGH8.5same product

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side softw...

CVE-2024-28247HIGH7.6same product

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-s...