CVE-2026-35521
Published: 07 April 2026
Description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows…
more
an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs to the dhcp.hosts configuration parameter to neutralize CRLF sequences and block arbitrary dnsmasq directives, directly preventing the command injection RCE.
Mandates timely remediation of flaws like this RCE vulnerability by patching Pi-hole FTL to version 6.6 or later.
Restricts access to system components controlling changes to the vulnerable dhcp.hosts parameter, limiting exploitation opportunities for low-privilege authenticated attackers.
Security SummaryAI
CVE-2026-35521 is a Remote Code Execution (RCE) vulnerability in the Pi-hole FTL engine, also known as FTLDNS, which provides an interactive API and generates statistics for Pi-hole's Web interface. The issue affects versions from 6.0 up to but not including 6.6 and stems from the DHCP hosts configuration parameter (dhcp.hosts), where attackers can inject arbitrary dnsmasq configuration directives through newline characters ('CRLF injection'), ultimately achieving command execution on the underlying system. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences).
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation allows the attacker to execute arbitrary commands on the host system, resulting in high impacts to confidentiality, integrity, and availability.
The vulnerability is addressed in Pi-hole FTL version 6.6. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via OS command injection (CWE-78) in Pi-hole FTL API/web interface (public-facing application), directly enabling T1190; exploits Unix shell for command execution (T1059.004).