CVE-2026-35521

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35521

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35521.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35521

Aliases

GHSA-vfmq-jrx3-wv3c

Published

2026-04-07T15:20:26.583Z

Modified

2026-07-15T01:49:11.899081263Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

Details

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35521.json",
    "cwe_ids": [
        "CWE-78",
        "CWE-93"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/pi-hole/ftl

Affected ranges

Type

GIT

Repo

https://github.com/pi-hole/ftl

Events

Introduced

eaa7dbb4cf4316413558c9d4b4e3f2a44f8e8203

Fixed

71b6fc62571075740a3c721d5e961db9c3609376

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.6"
        },
        {
            "last_affected": "6.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*"
}

Affected versions

v6.*

v6.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1

v6.2

v6.2.1

v6.2.2

v6.2.3

v6.3

v6.3.1

v6.3.2

v6.3.3

v6.4.1

v6.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35521.json"