CVE-2026-35518

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) FTLDNS (pihole-FTL) proporciona una API interactiva y también genera estadísticas para la interfaz web de Pi-hole. Desde la versión 6.0 hasta antes de la 6.6, el motor FTL de Pi-hole contiene una vulnerabilidad de ejecución remota de código (RCE) en el parámetro de configuración de registros DNS CNAME (dns.cnameRecords). Esta vulnerabilidad permite a un atacante autenticado inyectar directivas de configuración arbitrarias de dnsmasq a través de caracteres de nueva línea, logrando finalmente la ejecución de comandos en el sistema subyacente. Esta vulnerabilidad está corregida en la versión 6.6.

Information

Published : 2026-04-07 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35518

Mitre link : CVE-2026-35518

CVE.ORG link : CVE-2026-35518

JSON object : View

Products Affected

pi-hole

ftldns

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-35518", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35518", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T14:54:51.921500Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pi-hole", "product": "FTL", "versions": [{"status": "affected", "version": ">= 6.0, < 6.6"}]}]}], "published": "2026-04-07T16:16:28.243", "references": [{"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6."}, {"lang": "es", "value": "FTLDNS (pihole-FTL) proporciona una API interactiva y tambi\u00e9n genera estad\u00edsticas para la interfaz web de Pi-hole. Desde la versi\u00f3n 6.0 hasta antes de la 6.6, el motor FTL de Pi-hole contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en el par\u00e1metro de configuraci\u00f3n de registros DNS CNAME (dns.cnameRecords). Esta vulnerabilidad permite a un atacante autenticado inyectar directivas de configuraci\u00f3n arbitrarias de dnsmasq a trav\u00e9s de caracteres de nueva l\u00ednea, logrando finalmente la ejecuci\u00f3n de comandos en el sistema subyacente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 6.6."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C927FF0-74A4-4F13-95A8-E80C5E80F607", "versionEndIncluding": "6.5", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}