Pi-hole vulnerabilities
38 CVEs and advisories name Pi-hole as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119336Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
- CVE-2026-119335Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass
- CVE-2026-119334Pi-hole: file:// adlist read check and curl can resolve different files
- CVE-2026-50130Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
- CVE-2026-44693Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer
- CVE-2026-41489Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks
- CVE-2026-39849Pi-hole FTL remote code execution via newline injection in dns.interface configuration
- CVE-2026-35521Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
- CVE-2026-35520Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
- CVE-2026-35519Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
- CVE-2026-35518Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection
- CVE-2026-35517Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
- CVE-2026-35491Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration
- CVE-2026-33405Pi-hole has a Stored HTML Injection in queries.js
- CVE-2026-33727Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).
- CVE-2026-33406Pi-hole has a Stored HTML attribute injection
- CVE-2026-33404Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard
- CVE-2026-33403Pi-hole has a Reflected XSS / HTML injection in taillog.js
- CVE-2026-33765Pi-hole Web Interface has a Command Injection Vulnerability
- CVE-2026-26953Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table
- CVE-2026-26952Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute
- CVE-2025-59151Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
- CVE-2025-53533Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
- CVE-2025-32785Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
- CVE-2025-34087Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
- CVE-2024-34361Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
- CVE-2024-28247Pihole Authenticated Arbitrary File Read with root privileges
- CVE-2023-23614Improper session handling of "Remember me for 7 days" functionality
- CVE-2022-23513Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
- CVE-2022-31029Authenticated XSS in Pi-hole AdminLTE