PT-2026-28535 · Pi-Hole · Pi-Hole

Maydaysun · Published 2026-03-27 · Updated 2026-03-29 · CVE-2026-33765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 6.0

Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole ad and internet tracker blocking application, contains an OS Command Injection issue in the savesettings.php file. The application directly incorporates the user-controlled $ POST['webtheme'] parameter into a system command executed using PHP’s exec() function without proper sanitization or validation. This allows an attacker to append and execute arbitrary system commands with elevated (root) privileges through the use of sudo.

Recommendations Update to version 6.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-33765

GHSA-828H-5X96-RQX7

Affected Products

Pi-Hole

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33765.json · Exploit
• https://github.com/pi-hole/web/security/advisories/GHSA-828h-5x96-rqx7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33765 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33765 · Vendor Advisory
• https://twitter.com/vuldb/status/2038251388535505093 · Twitter Post
• https://twitter.com/CVEnew/status/2037719411558424664 · Twitter Post
• https://twitter.com/vuldb/status/2037930010796085644 · Twitter Post