CVE-2021-32706

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32706
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32706.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32706
Aliases
  • GHSA-5cm9-6p3m-v259
Published
2021-08-04T18:15:09Z
Modified
2026-08-27T08:14:44Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the validDomainWildcard preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.

References

Affected packages

Git / github.com/pi-hole/web

Affected ranges

Type
GIT
Repo
https://github.com/pi-hole/web
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb9bd561fdf936891370d85b32e899dff1dbf9d4
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.5.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
1.*
1.0
1.1
1.2
1.2.1
2.*
2.0.0
2.1.0
2.1.1
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.2
v1.3
v1.4
v1.4.1
v1.4.2
v1.4.3
v1.4.3.1
v1.4.3.1a
v1.4.4
v1.4.4.1
v1.4.4.2
v2.*
v2.0
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.5
v2.1
v2.1.0-alpha-1
v2.1.0-beta
v2.1.2
v2.2
v2.2.0
v2.3
v2.3.1
v2.4
v2.5
v2.5.1
v2.5.2
v3.*
v3.0
v3.0.1
v3.0.1a
v3.1
v3.2
v3.2.1
v3.3
v4.*
v4.0
v4.1
v4.1.1
v4.2
v4.3
v4.3.2
v4.3.3
v5.*
v5.0
v5.1
v5.1.1
v5.2
v5.2.1
v5.2.2
v5.3
v5.3.1
v5.3.2
v5.4
v5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32706.json"