Executive brief
Pi-hole is a network-wide ad and tracker blocker. A security vulnerability allows a user who already has limited access to the Pi-hole system to gain full administrative (root) control. By replacing a specific configuration file and forcing the system to restart a background service, an attacker can trick the system into running malicious commands with the highest possible privileges during daily maintenance tasks.
Technical details
A local privilege escalation vulnerability exists in Pi-hole versions 6.0 through 6.4.2. The root cause is a combination of insecure directory permissions for /etc/pihole/ (owned by the pihole user) and a 'laundering' mechanism in the pihole-FTL-prestart.sh script. An attacker with code execution as the 'pihole' user can delete the root-owned /etc/pihole/logrotate file and replace it with a malicious version. By restarting the pihole-FTL service (which the pihole user can do via SIGKILL), the prestart script runs as root and unconditionally changes the ownership of the malicious logrotate file back to root:root. When the daily cron job subsequently executes logrotate as root, it parses the attacker-controlled configuration, allowing for arbitrary command execution as root via logrotate script blocks (e.g., firstaction). This is fixed in version 6.4.3.
Affected products
- Pi-hole Pi-hole 6.0 to 6.4.2
Timeline
- 2026-07-06: patched: Fixed in version 6.4.3
- 2026-07-14: disclosed: Public advisory published