Pi-hole up to 6.4 Scripts updatecheck.sh symlink

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Pi-hole up to 6.4. This issue affects some unknown processing of the file advanced/Scripts/updatecheck.sh of the component Scripts. This manipulation causes symlink. This vulnerability is tracked as CVE-2026-119336. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Pi-hole up to 6.4 and classified as very critical. Affected by this vulnerability is an unknown functionality of the file advanced/Scripts/updatecheck.sh of the component Scripts. The manipulation with an unknown input leads to a symlink vulnerability. The CWE definition for the vulnerability is CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-119336 since 10/29/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/30/2026).

Upgrading to version 6.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Pi-hole

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4

Website

• Product: https://github.com/pi-hole/pi-hole/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion