Pi-hole discloses CVE-2026-119336, a high-severity root file-permission flaw
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Pi-hole
- Product
- Pi-hole
- First seen
Summary
A TheHackerWire advisory reports CVE-2026-119336, rated High (7.8), in Pi-hole versions from 6.4.2 until 6.5. The item says a root-run cron script in updatecheck.sh truncates and changes permissions on a Pi-hole version file.
If you use Pi-hole
Update Pi-hole to version 6.5 or later
Check file permissions on /etc/pihole after updating
Review the advisory for workarounds if you cannot update yet
Review the advisory for details on exploitation conditions
Confirm your installation reports the patched version
Upgrade Pi-hole to 6.5 or later
What the sources say 3
· Mastodon: “Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_...” Source
· Mastodon: “From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versi...” Source
· Mastodon: “From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while” Source