Pi-hole Core: Arbitrary root file truncation and chmod via symlink in updatecheck.sh
Summary
Pi-hole Core's root-run update check cron job (updatecheck.sh) truncates and changes the permissions of /etc/pihole/versions while following symbolic links inside the pihole-owned directory. A local attacker running as the pihole user can replace that path with a symlink, so root truncates or creates an arbitrary root-owned file, or makes a sensitive file world-readable through a race. Exploitation requires local code execution as the pihole account.
Affected
- Pi-hole Core 6.4.2 up to, but not including, 6.5 (CNA range: >= 6.4.2, < 6.5)
Fixed in
- Pi-hole Core 6.5
Workaround
- Unknown. Upgrading to Pi-hole Core 6.5 is the remedy.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total.
- No evidence of active exploitation known.
- The GitHub advisory describes the issue in enough detail that a reproduction is public. EPSS: 0.25 %.
Our recommendation
- Update Pi-hole Core to 6.5 or later. For Docker, verify the image tag contains the fix before relying on it.
- Check that no untrusted local accounts or services share the Pi-hole host.
- Review file permissions in /etc/pihole.
- Treat the host as higher priority if it is shared with other users or services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xch2-4qxw-g5vj github.com
- Pi-hole Core v6.5 release github.com
- Fix commit 85de82d (review feedback) github.com
- Fix commit c1062f4 (root must not write version file) github.com
- Pi-hole blog: FTL v6.8, Web v6.6.1 and Core v6.5 released pi-hole.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:38.
Original description (NVD)
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
NVD references (6)
- https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25
- https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb
- https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517
- https://github.com/pi-hole/pi-hole/pull/6719
- https://github.com/pi-hole/pi-hole/releases/tag/v6.5
- https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.