pi-hole FTL up to 6.6.0 Configuration API /etc/pihole/pihole.toml crlf injection

Summaryinfo

A vulnerability, which was classified as problematic, has been found in pi-hole FTL up to 6.6.0. The affected element is an unknown function of the file /etc/pihole/pihole.toml of the component Configuration API. Performing a manipulation results in crlf injection. This vulnerability is reported as CVE-2026-39849. The attacker must have access to the local network to execute the attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in pi-hole FTL up to 6.6.0. It has been classified as problematic. This affects an unknown functionality of the file /etc/pihole/pihole.toml of the component Configuration API. The manipulation with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set (the default for many deployments), the configuration API is fully accessible without credentials, allowing a network-adjacent attacker to inject the payload, enable the built-in DHCP server, and achieve arbitrary command execution on the host the next time any device on the network requests a DHCP lease. The injected value is persisted to /etc/pihole/pihole.toml and survives restarts. The strncpy in the code path limits the total interface field to 31 bytes, but payloads such as wlan0\ndhcp-script=/tmp/p fit within this constraint. The dnsmasq config validation introduced in FTL 6.6 only checks syntactic validity, so valid directives injected via newline pass validation successfully. This issue has been fixed in version 6.6.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-39849 since 04/07/2026. The exploitability is told to be easy. The attack can only be done within the local network. Technical details are known, but no exploit is available.

Upgrading to version 6.6.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0c46e4ec7fe57f762fce261625f2cf5d43806e6d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27498). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• pi-hole

Name

• FTL

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6.0

License

• open-source

Website

• Product: https://github.com/pi-hole/FTL/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion