Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-119336: Pi-hole may let attacker overwrite or expose files
CVE-2026-119336 · published 5 days ago
Summary
The Pi-hole service runs a scheduled task as root that modifies the file /etc/pihole/versions. If an attacker can act as the regular pi-hole user, they can replace that path with a link to any file, causing the root task to erase or change the file, or make it readable by anyone. Updating Pi-hole to version 6.5 or later stops this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pi-hole | pi-hole | >= 6.4.2, < 6.5 |
Original advisory text
Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
References
- https://github.com/pi-hole/pi-hole/releases/tag/v6.5 URL
- https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f... Patch
- https://github.com/pi-hole/pi-hole/pull/6719 Patch
- https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj Vendor Advisory
- https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366... Patch
- https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb90565335... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1193... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-119336 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-59Link Following
CWE-61UNIX Symbolic Link (Symlink) Following
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Sources
CVE-2026-119336 · NVD
CVE-2026-119336 · MITRE
CVE-2026-119336 · OSV
GHSA-xch2-4qxw-g5vj · GHSA
Track software like this
Free during beta