Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-35517 EUVD-2026-19684

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

Published Apr 7, 2026 · Updated Apr 7, 2026 · Assigned by GitHub_M

Vendor: pi-hole Product: FTL

Description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Affected products

VendorProductAffectedFixed
pi-hole FTL >= 6.0, < 6.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • keraattin/CVE-2026-35517 ★ 0 · Apr 14, 2026

    CVE-2026-35517 Pi-hole FTLDNS Remote Code Execution via Newline Injection (CVSS 8.8). Python & Nmap NSE detection scripts with full technical breakdown. A newline character in the dns.upstreams param…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References