PT-2026-28535 · Pi-Hole · Pi-Hole

Maydaysun · Publicado 2026-03-27 · Atualizado 2026-03-29 · CVE-2026-33765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 6.0

Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole ad and internet tracker blocking application, contains an OS Command Injection issue in the savesettings.php file. The application directly incorporates the user-controlled $ POST['webtheme'] parameter into a system command executed using PHP’s exec() function without proper sanitization or validation. This allows an attacker to append and execute arbitrary system commands with elevated (root) privileges through the use of sudo.

Recommendations Update to version 6.0 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-33765

GHSA-828H-5X96-RQX7

Produtos afetados

Pi-Hole

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33765.json · Exploit
• https://github.com/pi-hole/web/security/advisories/GHSA-828h-5x96-rqx7 · Aviso do Fabricante
• https://twitter.com/vuldb/status/2038251388535505093 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037719411558424664 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33765 · Nota de Segurança
• https://twitter.com/vuldb/status/2037930010796085644 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33765 · Aviso do Fabricante