CVE-2026-35519

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35519

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35519.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35519

Aliases

GHSA-wxhv-w77q-6qwp

Published

2026-04-07T15:18:27.377Z

Modified

2026-07-15T01:49:02.023443955Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

Details

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Database specific

{
    "cwe_ids": [
        "CWE-78",
        "CWE-93"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35519.json"
}

References

Affected packages

Git / github.com/pi-hole/ftl

Affected ranges

Type

GIT

Repo

https://github.com/pi-hole/ftl

Events

Introduced

eaa7dbb4cf4316413558c9d4b4e3f2a44f8e8203

Fixed

71b6fc62571075740a3c721d5e961db9c3609376

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.6"
        },
        {
            "last_affected": "6.5"
        }
    ]
}

Affected versions

v6.*

v6.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1

v6.2

v6.2.1

v6.2.2

v6.2.3

v6.3

v6.3.1

v6.3.2

v6.3.3

v6.4.1

v6.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35519.json"