Pi-hole up to 6.4.2 logrotate /etc/pihole/logrotate flush os command injection

Summaryinfo

A vulnerability was found in Pi-hole up to 6.4.2. It has been classified as very critical. Affected by this issue is the function flush of the file /etc/pihole/logrotate of the component logrotate. Performing a manipulation of the argument logrotate results in os command injection. This vulnerability was named CVE-2026-50130. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Pi-hole up to 6.4.2. This affects the function flush of the file /etc/pihole/logrotate of the component logrotate. The manipulation of the argument logrotate with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-50130 since 06/03/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/15/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading to version 6.4.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Pi-hole

Version

• 6.4.0
• 6.4.1
• 6.4.2

Website

• Product: https://github.com/pi-hole/pi-hole/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion