Pi-hole up to 6.4.1 pihole-FTL-prestart.sh permission assignment

Summaryinfo

A vulnerability has been found in Pi-hole up to 6.4.1 and classified as problematic. Affected is an unknown function of the file pihole-FTL-prestart.sh. This manipulation causes permission assignment. This vulnerability is handled as CVE-2026-41489. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Pi-hole up to 6.4.1 and classified as problematic. Affected by this vulnerability is an unknown part of the file pihole-FTL-prestart.sh. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1, two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read the files.pid path from this config without validation and use it in privileged file operations (install and rm -f). By writing an arbitrary path into files.pid, an attacker with pihole privilege can cause root to delete and then recreate any file on the system outside the ProtectSystem=full-restricted directories, gaining write access to it. On a default Pi-hole installation this yields local privilege escalation to root via SSH authorized keys manipulation. If /root/.ssh/authorized_keys does not exist (default on fresh installs), only ExecStartPre is required. If the file exists, ExecStopPost deletes it first, and the same restart triggers both hooks in sequence. This vulnerability is fixed in Core 6.4.2 and FTL 6.6.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-41489 since 04/20/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 321187 (Pi-Hole Web 6.x < 6.4.2 (Core) Local Privilege Escalation (CVE-2026-41489)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.4.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (321187). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Pi-hole

Version

• 6.4.0
• 6.4.1

Website

• Product: https://github.com/pi-hole/pi-hole/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion