CVE-2026-41489
Path Traversal in Pi-hole Core and FTL
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pi-hole | core | From 6.0 (inc) to 6.4.2 (exc) |
| pi-hole | ftl | From 6.0 (inc) to 6.6.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Pi-hole versions from 6.0 to before Core 6.4.2 and FTL 6.6.1. Two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read a file path from the configuration without validating it. An attacker with pihole privilege can write an arbitrary path into this configuration, causing the scripts to delete and recreate any file on the system outside certain restricted directories with root privileges.
On a default Pi-hole installation, this allows local privilege escalation to root by manipulating SSH authorized keys. If the root SSH authorized_keys file does not exist, only one script execution is needed; if it exists, both scripts run in sequence during a restart to achieve the exploit.
This vulnerability was fixed in Core 6.4.2 and FTL 6.6.1.
How can this vulnerability impact me? :
This vulnerability can lead to local privilege escalation, allowing an attacker with limited Pi-hole privileges to gain root access on the affected system.
With root access, the attacker can manipulate critical system files, including SSH authorized keys, potentially allowing persistent unauthorized access and full control over the system.
This can compromise the security and integrity of the system, leading to data breaches, system manipulation, or further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Pi-hole Core to version 6.4.2 or later and Pi-hole FTL to version 6.6.1 or later, as these versions contain the fix.
Until the upgrade is applied, restrict access to the pihole user privileges to prevent attackers from writing arbitrary paths into files.pid.