PT-2026-37240 · Pi-Hole · Pi-Hole Ftl

Anuraagbaishya · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-39849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi-hole FTL versions prior to 6.6.1

Description The dns.interface configuration field in Pi-hole FTL accepts newline characters without validation, which allows an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations where no admin password is set, the configuration API is accessible without credentials. This enables a network-adjacent attacker to inject a payload, enable the built-in DHCP server, and achieve arbitrary command execution on the host when a device on the network requests a DHCP lease. The injected value is persisted to /etc/pihole/pihole.toml and remains after restarts. Although the strncpy function limits the interface field to 31 bytes, payloads such as wlan0 dhcp-script=/tmp/p can still fit. The dnsmasq configuration validation in FTL 6.6 only verifies syntactic validity, allowing valid injected directives to pass.

Recommendations Update to version 6.6.1.

Exploit

Fix

RCE

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-39849

Affected Products

Pi-Hole Ftl

References · 9

• 🔥 https://github.com/pi-hole/FTL/security/advisories/GHSA-9cqv-839p-gpq2 · Exploit
• https://github.com/pi-hole/FTL/commit/0c46e4ec7fe57f762fce261625f2cf5d43806e6d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39849 · Security Note
• https://github.com/pi-hole/FTL/releases/tag/v6.6.1 · Note
• https://twitter.com/VulmonFeeds/status/2051910587131539904 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051779332503208390 · Twitter Post
• https://t.me/CVEtracker/52797 · Telegram Post
• https://twitter.com/CVEnew/status/2051777784008135013 · Twitter Post
• https://t.me/cveNotify/163252 · Telegram Post