CVE-2026-119335— Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass

Quick assessment

Affected

pi-hole pi-hole

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pi-hole 是一个 DNS 拦截服务（DNS sinkhole），可在无需安装任何客户端软件的情况下，保护设备免受不良内容侵害。在 6.5 版本之前，位于中的函数尝试通过表达式来验证由 pihole 用户拥有的文件。然而，该验证仅能拒绝首字符非数字的值。若攻击者能以 pihole 用户身份执行代码，便可向该由 pihole 用户拥有的 PID 文件中写入一个以数字开头的算术表达式。随后，以 root 权限运行的 pihole 子命令会执行判断，导致 Bash 递归地解析数组下标并执行命令替换，从而以

CVSS 7.8 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1055.005 · Thread Local Storage T1068 · Exploitation for Privilege Escalation T1203.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass

Source: CVE Program / CVE List V5

Vulnerability Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pi-hole	pi-hole	< 6.5	-

II. Public POCs for CVE-2026-119335

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119335

请登录查看更多情报信息。

Other References for CVE-2026-119335 (4)

https://github.com/pi-hole/pi-hole/pull/6719 x_refsource_MISC
https://github.com/pi-hole/pi-hole/releases/tag/v6.5 x_refsource_MISC
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398 x_refsource_CONFIRM
https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119335

Same Patch Batch · pi-hole · 2026-10-30 · 3 CVEs total

CVE-2026-119336	7.8 HIGH	Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron followin
CVE-2026-119334	2.2 LOW	Pi-hole: file:// adlist read check and curl can resolve different files

IV. Related Vulnerabilities

Same product: pi-hole

Same vendor: pi-hole

Same weakness: CWE-78