CVE-2026-119335 in Pi-hole
Summary
by MITRE • 10/30/2026
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
Pi-hole serves as a network-wide DNS sinkhole designed to block advertisements and malicious domains without requiring client-side software installation, relying heavily on the FTL engine for performance and functionality. The vulnerability described involves a critical flaw in the script logic located within advanced/Scripts/utils.sh, specifically in the getFTLPID function which is responsible for validating the process ID stored in the pihole-owned /run/pihole-FTL.pid file prior to version 6.5. This validation mechanism was intended to ensure that only valid numeric identifiers are processed by subsequent root-level commands, thereby preventing arbitrary code execution through manipulated PID files.
The technical flaw stems from an insufficient regular expression used for input sanitization. The function employs the expr command with a pattern designed to reject values whose first character is not a digit. However, this check is logically incomplete because it only validates the initial character of the string rather than ensuring the entire value consists solely of digits. Consequently, if an attacker achieves code execution as the pihole user, they can write a carefully crafted payload into the PID file that begins with a valid digit but contains malicious arithmetic expressions or command substitution syntax in subsequent characters. This allows the input to pass the superficial validation check while retaining its harmful structural properties.
When root-run pihole subcommands subsequently interact with this manipulated PID value, they perform an integer comparison using the Bash conditional expression [[ "$pid" -eq "-1" ]]. In older versions of Bash and under specific parsing conditions involving array subscripts or complex variable expansions triggered by the malformed input, this evaluation can lead to recursive processing that inadvertently executes command substitution. This results in arbitrary code execution with root privileges, effectively bypassing the security controls intended to mitigate similar vulnerabilities such as CVE-2026-41489. While the hardcoded protection of the PID file path remains intact, preventing unauthorized writes from outside the pihole user context, the internal validation logic fails to sanitize the content adequately once write access is established by a lower-privileged attacker with shell access.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection, as it involves failing to properly neutralize special elements used in operating system commands due to inadequate sanitization of user-supplied data. From an ATT&CK perspective, this represents a privilege escalation vector where an attacker leverages insufficient validation within a trusted application component to execute code with higher privileges, specifically mapping to techniques involving command and script interpretation via local file manipulation or process injection mechanisms. The impact is severe as it grants full root access on the host system running Pi-hole, potentially allowing complete compromise of the network infrastructure protected by the sinkhole.
Mitigation requires upgrading to version 6.5 or later where this validation logic has been corrected to ensure strict numeric-only input handling. Until an upgrade can be performed, administrators should restrict file permissions on /run/pihole-FTL.pid to prevent any non-root user from writing to it, although the primary attack vector assumes prior code execution as the pihole user which may already imply compromised system integrity. Additionally, implementing principle of least privilege by running Pi-hole components with minimal necessary permissions and monitoring for unusual process creation events can help detect exploitation attempts in real-time.