CVE-2026-119334 in Pi-hole
Summary
by MITRE • 10/30/2026
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Pi-hole versions prior to 6.5 represents a critical privilege escalation flaw rooted in improper input validation during the processing of DNS sinkhole adlists. Pi-hole functions as a network-wide advertisement and tracker blocking service, relying on gravity.sh scripts to update its blocklist database from remote or local sources. The core technical failure lies in the discrepancy between the initial file accessibility check and the subsequent data retrieval mechanism. Specifically, the script employs sudo -u pihole test -r to verify that the specified adlist file is readable by the unprivileged pihole user. This check ensures that a standard administrator cannot inadvertently or maliciously reference files outside their permitted scope during the validation phase. However, once this check passes, the script utilizes curl to fetch and normalize the content of the URL provided in the configuration.
This architectural inconsistency creates a classic time-of-check-to-time-of-use (TOCTOU) race condition combined with path traversal risks through URL normalization. When curl processes the input string, it normalizes dot segments such as ../ which can alter the final resolved file path on the filesystem. An attacker who possesses administrative privileges within Pi-hole and has write access to specific directories on the host system can exploit this by creating a symlink or decoy file that points to a sensitive location accessible only by root, such as /etc/shadow or other critical configuration files. Because the initial check validates readability for the pihole user against the original path string before normalization, and curl resolves the normalized path potentially pointing elsewhere, the security boundary is bypassed. The script effectively allows an unprivileged context to read privileged data because the validation step does not account for how URL parsing might redirect the actual file access operation.
Furthermore, the vulnerability extends beyond simple symlink attacks through the handling of /proc/self paths. Linux systems expose process-specific information via the /proc filesystem, where /proc/self refers to the current running process. If an attacker can manipulate the input such that curl resolves a path involving /proc/self/environ or similar entries, they may be able to read environment variables containing sensitive tokens, API keys, or other secrets associated with the root user executing the script. This aspect of the flaw highlights how system-specific features like symbolic links and virtual filesystems interact dangerously with URL parsing libraries that do not strictly enforce path canonicalization before access control checks are finalized. The operational impact is severe, as it allows an attacker to escalate privileges from a standard Pi-hole administrator account to effectively read arbitrary root-owned files on the host machine. This can lead to full system compromise if combined with other exploitation techniques or used to extract credentials for further lateral movement within the network infrastructure protected by Pi-hole.
Mitigation strategies primarily involve upgrading to version 6.5 where this logic has been corrected to ensure consistent path resolution and validation. In environments where immediate patching is not feasible, administrators should restrict file system permissions so that unprivileged users cannot create symlinks in directories used for adlist storage or configuration. Additionally, implementing strict input sanitization that rejects any URL containing relative path traversal sequences like ../ before they reach the curl command can provide a temporary defensive layer. It is also advisable to run Pi-hole components with minimal necessary privileges and avoid running update scripts as root if possible, although this may require significant architectural changes depending on deployment specifics. This vulnerability aligns with CWE-59 Improper Link Resolution Before File Access and CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition within the Common Weakness Enumeration framework. From a tactical perspective, it reflects techniques associated with ATT&CK T1083 File and Directory Discovery as an attacker would probe for readable sensitive files to gather intelligence prior to exploitation.