CVE-2026-119335

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.

• CWE-78

• https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1
• https://github.com/pi-hole/pi-hole/pull/6719
• https://github.com/pi-hole/pi-hole/releases/tag/v6.5
• https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11933A use-after-free vulnerability exists in MongoDB Server's se…8.8
• CVE-2026-119330Immich is a high-performance self-hosted photo and video man…3.5
• CVE-2026-119331Ladybird is a truly independent web browser. Prior to the c0…7.1
• CVE-2026-119332Ladybird is a truly independent web browser. Prior to 209579…8.8
• CVE-2026-119333draw.io Desktop is the official Electron build of draw.io. P…7.8
• CVE-2026-119334Pi-hole is a DNS sinkhole that protects devices from unwante…2.2
• CVE-2026-119336Pi-hole is a DNS sinkhole that protects devices from unwante…7.8
• CVE-2026-119337RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…7.1
• CVE-2026-11934IBM Verify Identity Access could allow an administrator to e…7.2
• CVE-2026-11936IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…5.4
• CVE-2026-119364ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 conta…5.3
• CVE-2026-119365Improper Neutralization of Input During Web Page Generation …6.5