Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "${FTL_PID}" : "[^[:digit:]]", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ "$pid" -eq "-1" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…i-hole/security/advisories/GHSA-cf36-4hhc-8398 Diğer
• github.com/pi-hole/pi-hole/pull/6719 Diğer
• github.com/…ommit/555dd4d8b3699327fbba482bb73cce5f53979bd1 Diğer
• github.com/pi-hole/pi-hole/releases/tag/v6.5 Diğer

Kayıt geçmişi

1. 30 Eki 2026 23:03Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-119336Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
• 2,2 CVE-2026-119334Pi-hole: file:// adlist read check and curl can resolve different files
• 9,1 CVE-2020-8816 Aktif istismarPi-hole AdminLTE web arayüzünde DHCP kira kaydı ile uzaktan kod çalıştırma
• 9,9 CVE-2026-62853ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks
• 9,9 CVE-2026-116241pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
• 7,0 CVE-2026-119288Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line