Pi-hole Core: Privilege escalation to root via PID file validation bypass
Summary
Pi-hole Core before version 6.5 validates the PID file /run/pihole-FTL.pid incompletely. An attacker who already runs code as the pihole user can write a crafted arithmetic expression into this file, which root-run pihole subcommands then evaluate, executing commands as root. The issue bypasses the content validation of the fix for CVE-2026-41489. Exploitation requires prior local code execution as the pihole user.
Affected
- Pi-hole Core 6.4.3 and earlier (all versions before 6.5)
Fixed in
- Pi-hole Core 6.5
Workaround
Unknown. No vendor workaround is documented; upgrading is the only remedy in the sources.
Exploitation
- Technical details of the root cause and reproduction are public in the advisory.
- No reports of exploitation in the wild were found.
- EPSS: 0.23 % (percentile 14).
Our recommendation
- Upgrade Pi-hole Core to 6.5 or later, or to the latest release.
- Prioritise hosts where other services or users can reach the pihole account.
- Restrict who can run code as the pihole account and review root-run hooks and cron jobs that touch Pi-hole files.
- Treat as medium to high priority for SME DNS servers, and higher where Pi-hole runs with broad access or as a shared service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cf36-4hhc-8398 github.com
- Pi-hole Core v6.5 release github.com
- Fix commit 555dd4d github.com
- Pull request #6719 (Core v6.5) github.com
- Pi-hole release announcement 2026-10-17 pi-hole.net
- CVE aggregation (PT-2026-134181) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:37.
Original description (NVD)
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.