CVEvulnerability

CVE-2026-50130

8.8 HIGH Published 2026-07-14 Modified 2026-07-30 Official page ↗
Status
Analyzed
Published
2026-07-14
Last modified
2026-07-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-282

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Affected configurations

• pi-hole pi-hole (>= 6.0 < 6.4.3)

Related

Weakness · CWE (1)

  • CWE-282 Improper Ownership Management weakness

References