CVE-2026-41489
Path Traversal in Pi-hole Core and FTL
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pi-hole | core | From 6.0 (inc) to 6.4.2 (exc) |
| pi-hole | ftl | From 6.0 (inc) to 6.6.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Pi-hole Core versions from 6.0 to before 6.4.2 and FTL versions before 6.6.1, where two shell scripts executed as root by systemd read an unvalidated files.pid path from the configuration and perform privileged file operations. Detection involves verifying the installed versions of Pi-hole Core and FTL to see if they fall within the vulnerable range.
To detect if your system is vulnerable, you can check the installed versions of Pi-hole Core and FTL using the following commands:
- pihole -v
This command outputs the versions of Core and FTL. If Core is between 6.0 and before 6.4.2, or FTL is before 6.6.1, the system is vulnerable.
Additionally, you can inspect the systemd service files or the scripts pihole-FTL-prestart.sh and pihole-FTL-poststop.sh to check if they are present and executed as root, which is part of the vulnerability mechanism.
Since the vulnerability involves manipulation of the files.pid path, you may also check for suspicious entries or modifications in the Pi-hole configuration files related to files.pid.
Can you explain this vulnerability to me?
This vulnerability exists in Pi-hole versions from 6.0 to before Core 6.4.2 and FTL 6.6.1. Two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read a file path from the configuration without validating it. An attacker with pihole privilege can write an arbitrary path into this configuration, causing the scripts to delete and recreate any file on the system outside certain restricted directories with root privileges.
On a default Pi-hole installation, this allows local privilege escalation to root by manipulating SSH authorized keys. If the root SSH authorized_keys file does not exist, only one script execution is needed; if it exists, both scripts run in sequence during a restart to achieve the exploit.
This vulnerability was fixed in Core 6.4.2 and FTL 6.6.1.
How can this vulnerability impact me? :
This vulnerability can lead to local privilege escalation, allowing an attacker with limited Pi-hole privileges to gain root access on the affected system.
With root access, the attacker can manipulate critical system files, including SSH authorized keys, potentially allowing persistent unauthorized access and full control over the system.
This can compromise the security and integrity of the system, leading to data breaches, system manipulation, or further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Pi-hole Core to version 6.4.2 or later and Pi-hole FTL to version 6.6.1 or later, as these versions contain the fix.
Until the upgrade is applied, restrict access to the pihole user privileges to prevent attackers from writing arbitrary paths into files.pid.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a local attacker with pihole privileges to escalate to root by manipulating file operations, potentially leading to unauthorized access and modification of sensitive system files.
Such unauthorized root access and file manipulation could lead to breaches of confidentiality, integrity, and availability of data, which are critical aspects of compliance with standards like GDPR and HIPAA.
However, the provided information does not explicitly describe the impact on compliance with these regulations.