CVE-2026-35517

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35517

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35517.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35517

Aliases

GHSA-23w8-7333-p9fj

Published

2026-04-07T15:16:02.955Z

Modified

2026-07-08T08:12:59.051614835Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

Details

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35517.json",
    "cwe_ids": [
        "CWE-78",
        "CWE-93"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/pi-hole/ftl

Affected ranges

Type

GIT

Repo

https://github.com/pi-hole/ftl

Events

Introduced

eaa7dbb4cf4316413558c9d4b4e3f2a44f8e8203

Fixed

71b6fc62571075740a3c721d5e961db9c3609376

Database specific

{
    "cpe": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.6"
        },
        {
            "last_affected": "6.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v6.*

v6.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1

v6.2

v6.2.1

v6.2.2

v6.2.3

v6.3

v6.3.1

v6.3.2

v6.3.3

v6.4.1

v6.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35517.json"