CVE-2026-35520

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35520

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35520.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35520

Aliases

GHSA-fqv2-qhfh-ghcj

Published

2026-04-07T15:19:21.875Z

Modified

2026-07-15T01:49:02.319229274Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

Details

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35520.json",
    "cwe_ids": [
        "CWE-78",
        "CWE-93"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/pi-hole/ftl

Affected ranges

Type

GIT

Repo

https://github.com/pi-hole/ftl

Events

Introduced

eaa7dbb4cf4316413558c9d4b4e3f2a44f8e8203

Fixed

71b6fc62571075740a3c721d5e961db9c3609376

Database specific

{
    "cpe": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.6"
        },
        {
            "last_affected": "6.5"
        }
    ]
}

Affected versions

v6.*

v6.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1

v6.2

v6.2.1

v6.2.2

v6.2.3

v6.3

v6.3.1

v6.3.2

v6.3.3

v6.4.1

v6.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35520.json"