CVE-2026-119334— Pi-hole: file:// adlist read check and curl can resolve different files

Quick assessment

Affected

pi-hole pi-hole

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pi-hole 是一个 DNS 黑洞（DNS sinkhole）服务，能够在无需安装任何客户端软件的情况下，保护设备免受不良内容的影响。在 6.5 版本之前，脚本会使用检查广告列表（adlist）的可读性，但随后允许（有时以 root 权限运行）对 URL 中的点段（dot segments）进行规范化处理，并可能打开不同的文件。因此，攻击者可以创建一个对用户可读的诱饵文件，使其通过权限检查，而实际读取的却是仅 root 用户可访问的目标文件；类似地，路径也可能在不同进程上下文中解析为不同的目标。利用

CVSS 2.2 · Low Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Pi-hole: file:// adlist read check and curl can resolve different files

Source: CVE Program / CVE List V5

Vulnerability Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pi-hole	pi-hole	< 6.5	-

II. Public POCs for CVE-2026-119334

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119334

请登录查看更多情报信息。

Other References for CVE-2026-119334 (4)

https://github.com/pi-hole/pi-hole/pull/6719 x_refsource_MISC
https://github.com/pi-hole/pi-hole/releases/tag/v6.5 x_refsource_MISC
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6 x_refsource_CONFIRM
https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119334

Same Patch Batch · pi-hole · 2026-10-30 · 3 CVEs total

CVE-2026-119336	7.8 HIGH	Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron followin
CVE-2026-119335	7.8 HIGH	Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix byp

IV. Related Vulnerabilities

Same product: pi-hole

Same vendor: pi-hole

Same weakness: CWE-59