Cyber Posture

CVE-2026-35518

High

Published: 07 April 2026

Published
07 April 2026
Modified
08 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0048 65.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability…

more

allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the RCE vulnerability by updating Pi-hole FTL from vulnerable versions (6.0 to <6.6) to the patched version 6.6.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes inputs to the dns.cnameRecords API parameter to block newline injection of arbitrary dnsmasq directives, preventing OS command injection.

CM-6 Configuration Settings partial match
prevent

Enforces secure baseline configuration settings for Pi-hole FTL and dnsmasq to restrict improper CNAME records that could enable command execution.

Security SummaryAI

CVE-2026-35518 is a Remote Code Execution (RCE) vulnerability, rated 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting the Pi-hole FTL engine (also known as FTLDNS), which provides an interactive API and generates statistics for Pi-hole's web interface. The issue impacts versions from 6.0 up to but not including 6.6 and stems from the DNS CNAME records configuration parameter (dns.cnameRecords). It allows injection of arbitrary dnsmasq configuration directives via newline characters, enabling command execution on the underlying system. The vulnerability is linked to CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences).

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation grants high impacts on confidentiality, integrity, and availability, culminating in arbitrary command execution on the host system.

The vulnerability is addressed in Pi-hole FTL version 6.6. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m.

Details

CWE(s)
CWE-78CWE-93

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

RCE via OS command injection (CWE-78) in Pi-hole FTL API (web interface service) directly enables exploitation of public-facing application (T1190), exploitation of remote service (T1210), and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References