CVE-2026-119335

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 6.5

Description Pi-hole is a DNS sinkhole that protects devices from unwanted content. The getFTLPID() function in advanced/Scripts/utils.sh incorrectly validates the /run/pihole-FTL.pid file using a regular expression that only rejects values where the first character is not a digit. An attacker with code execution privileges as the pihole user can write a digit-prefixed arithmetic expression to this PID file. When root-run pihole subcommands evaluate the variable pid in the expression [[ "$pid" -eq "-1" ]], Bash recursively evaluates array subscripts, leading to command substitution and arbitrary code execution as root.

Recommendations Update to version 6.5.