Executive brief
Pi-hole is a network-wide ad and tracker blocker. A security flaw allows a user with limited access to the Pi-hole service to trick the system into deleting or creating files with administrative (root) privileges. In practice, an attacker could use this to gain full control over the host machine, for example, by adding their own login keys to the administrator's account or corrupting critical system databases.
Technical details
A local privilege escalation vulnerability exists in Pi-hole versions 6.0 through Core 6.4.1 and FTL 6.6.0. The non-root 'pihole' user has write access to the configuration file 'pihole.toml'. Two shell scripts, 'pihole-FTL-prestart.sh' and 'pihole-FTL-poststop.sh', are executed as root by systemd and read the 'files.pid' path from this configuration without validation. By poisoning this path, an attacker can use 'rm -f' and 'install' commands within the scripts to delete arbitrary files or create new files owned by the 'pihole' user in sensitive locations (e.g., /root/.ssh/authorized_keys). This allows a low-privileged attacker to gain full root access or cause a denial of service by deleting critical system files. The issue is fixed in Core 6.4.2 and FTL 6.6.1.
Affected products
- Pi-hole Pi-hole Core 6.0 to before 6.4.2
- Pi-hole Pi-hole FTL 6.0 to before 6.6.1
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published by Pi-hole team
- 2026-05-11: disclosed: CVE-2026-41489 published to NVD