CVE-2026-119336— Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

Quick assessment

Affected

pi-hole pi-hole

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pi-hole 是一个 DNS 黑洞（DNS sinkhole）服务，可在无需安装任何客户端软件的情况下保护设备免受不良内容侵害。在 6.4.2 至 6.5 版本之间，由 root 用户执行的定时任务（cron job）会在由 pihole 用户拥有的目录中遍历符号链接，并对执行和操作。若攻击者以 pihole 用户身份运行，可将该路径替换为符号链接，从而利用计划执行的 root 操作截断或创建任意 root 拥有的文件；或者通过竞态条件（race condition），使将敏感目标文件设置为世界可读，而

CVSS 7.8 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

Source: CVE Program / CVE List V5

Vulnerability Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pi-hole	pi-hole	>= 6.4.2, < 6.5	-

II. Public POCs for CVE-2026-119336

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119336

请登录查看更多情报信息。

Other References for CVE-2026-119336 (6)

https://github.com/pi-hole/pi-hole/pull/6719 x_refsource_MISC
https://github.com/pi-hole/pi-hole/releases/tag/v6.5 x_refsource_MISC
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj x_refsource_CONFIRM
https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25 x_refsource_MISC
https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517 x_refsource_MISC
https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119336

Same Patch Batch · pi-hole · 2026-10-30 · 3 CVEs total

CVE-2026-119335	7.8 HIGH	Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix byp
CVE-2026-119334	2.2 LOW	Pi-hole: file:// adlist read check and curl can resolve different files

IV. Related Vulnerabilities

Same product: pi-hole

Same vendor: pi-hole

Same weakness: CWE-59