CVE-2026-119336 in Pi-hole
Summary
by MITRE • 10/30/2026
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified within Pi-hole versions ranging from 6.4.2 to 6.5 represents a critical privilege escalation flaw rooted in improper handling of symbolic links during scheduled system maintenance tasks. Pi-hole operates as a DNS sinkhole designed to block advertisements and malicious domains across networked devices without requiring client-side software installation. The specific defect resides within the advanced script updatecheck.sh, which is executed via cron with root privileges. This script interacts with the file /etc/pihole/versions by applying truncation operations using truncate -s 0 and modifying permissions using chmod 644. Crucially, these operations are performed while following symbolic links located in a directory owned by the pihole user rather than enforcing strict path validation or utilizing atomic operations that prevent link-following attacks.
An attacker who has achieved execution as the unprivileged pihole user can exploit this behavior to compromise system integrity and potentially escalate privileges. By replacing the target file /etc/pihole/versions with a symbolic link pointing to an arbitrary location on the filesystem, the attacker forces the root-executed script to operate on that unintended destination instead of the intended version tracking file. This mechanism allows for two primary attack vectors depending on timing and intent. First, if the symlink points to a sensitive system file such as /etc/shadow or /etc/passwd, the truncate operation will zero out its contents, effectively destroying critical authentication data and causing denial of service conditions that may require manual intervention to resolve. Second, in scenarios where truncation is bypassed due to race conditions or specific filesystem behaviors, the chmod 644 command can be leveraged to make sensitive root-owned files world-readable. This exposure allows any local user on the system to read confidential information such as password hashes, SSH keys, or other security-critical configurations that were previously protected by restrictive permissions.
This vulnerability aligns with CWE-59 Improper Link Resolution Before File Access, commonly known as a symbolic link following attack. The flaw exploits the lack of strict path canonicalization before performing destructive file operations under elevated privileges. From an offensive cybersecurity perspective, this behavior is consistent with ATT&CK technique T1068 Exploitation for Privilege Escalation, where attackers leverage misconfigurations in system services or scheduled tasks to gain higher levels of access. The impact extends beyond simple data corruption; the ability to modify permissions on root-owned files can facilitate further lateral movement within a networked environment if those exposed credentials are utilized by other processes or users with broader privileges.
Mitigation for this vulnerability requires immediate upgrading to Pi-hole version 6.5, which addresses these logic errors in the updatecheck script. Administrators should ensure that all scheduled tasks operating on files owned by unprivileged users implement strict path validation and avoid following symbolic links unless explicitly required and safely controlled. Additionally, applying principle of least privilege principles to cron jobs ensures that even if a local user compromises an account associated with those scripts, the blast radius is minimized. Regular auditing of file permissions in directories accessible to service accounts can also help detect similar misconfigurations before they are exploited.