CVE-2026-35519

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp	Vendor Advisory
https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) FTLDNS (pihole-FTL) proporciona una API interactiva y también genera estadísticas para la interfaz web de Pi-hole. Desde la versión 6.0 hasta antes de la 6.6, el motor FTL de Pi-hole contiene una vulnerabilidad de ejecución remota de código (RCE) en el parámetro de configuración del registro de host DNS (dns.hostRecord). Esta vulnerabilidad permite a un atacante autenticado inyectar directivas de configuración arbitrarias de dnsmasq a través de caracteres de nueva línea, logrando finalmente la ejecución de comandos en el sistema subyacente. Esta vulnerabilidad está corregida en la versión 6.6.

Information

Published : 2026-04-07 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35519

Mitre link : CVE-2026-35519

CVE.ORG link : CVE-2026-35519

JSON object : View

Products Affected

pi-hole

ftldns

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-35519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35519", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T16:12:50.932702Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pi-hole", "product": "FTL", "versions": [{"status": "affected", "version": ">= 6.0, < 6.6"}]}]}], "published": "2026-04-07T16:16:28.397", "references": [{"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6."}, {"lang": "es", "value": "FTLDNS (pihole-FTL) proporciona una API interactiva y tambi\u00e9n genera estad\u00edsticas para la interfaz web de Pi-hole. Desde la versi\u00f3n 6.0 hasta antes de la 6.6, el motor FTL de Pi-hole contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en el par\u00e1metro de configuraci\u00f3n del registro de host DNS (dns.hostRecord). Esta vulnerabilidad permite a un atacante autenticado inyectar directivas de configuraci\u00f3n arbitrarias de dnsmasq a trav\u00e9s de caracteres de nueva l\u00ednea, logrando finalmente la ejecuci\u00f3n de comandos en el sistema subyacente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 6.6."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C927FF0-74A4-4F13-95A8-E80C5E80F607", "versionEndIncluding": "6.5", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}