{"id":"CVE-2026-119335","aliases":[],"cve":{"records":[{"id":"CVE-2026-119335","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T20:44:30.285Z","published":"2026-10-30T20:03:32.975Z","modified":"2026-10-30T20:03:32.975Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:03:32.975Z"}],"references":[{"url":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/pi-hole/pi-hole/pull/6719","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489  fix bypass","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr \"${FTL_PID}\" : \"[^[:digit:]]\", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ \"$pid\" -eq \"-1\" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.","score":7.8,"severity":"high","published":"2026-10-30T20:03:32.975Z","modified":"2026-10-30T20:03:32.975Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"pi-hole","name":"pi-hole","platforms":[],"versions":[{"version":"< 6.5","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119335"}],"remediation":[],"references":["https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398","https://github.com/pi-hole/pi-hole/pull/6719","https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1","https://github.com/pi-hole/pi-hole/releases/tag/v6.5"],"sources":[{"name":"CVE","id":"CVE-2026-119335","modified":"2026-10-30T20:03:32.975Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119335"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T20:22:51.906Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T20:35:37.083Z","attemptedAt":"2026-10-30T20:35:37.083Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T20:35:37.301Z","attemptedAt":"2026-10-30T20:35:37.301Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T20:35:36.789Z","attemptedAt":"2026-10-30T20:35:36.789Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T20:35:37.338Z","attemptedAt":"2026-10-30T20:35:37.338Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119335","modified":"2026-10-30T20:17:08.137","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T20:35:37.083Z"}],"aiSummary":{"text":"Pi-hole versions before 6.5 have a local privilege escalation weakness. An attacker with code execution as the `pihole` user can write a malicious PID file, which is then evaluated by root-run pihole subcommands. This allows OS command injection as root.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:06:10.153Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119335"}]}}