{"id":"CVE-2026-119335","title":"Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489  fix bypass","summary":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with ex…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"pi-hole","product":"pi-hole","affected":["pi-hole < 6.5"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-05T02:37:28.938906Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:38:07.600Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119335","references":[{"url":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398","label":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398"},{"url":"https://github.com/pi-hole/pi-hole/pull/6719","label":"https://github.com/pi-hole/pi-hole/pull/6719"},{"url":"https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1","label":"https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1"},{"url":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5","label":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5"}],"tags":["cve.org","exploit-available"],"epss":0.00228,"epssPercentile":0.13682,"ingestedAt":"2026-11-05T21:36:00.702Z","slug":"CVE-2026-119335","body":"## Overview\n\nPi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr \"${FTL_PID}\" : \"[^[:digit:]]\", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ \"$pid\" -eq \"-1\" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.\n\n## Affected\n\n- `pi-hole < 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}