CVE-2026-35517

🗓️ 07 Apr 2026 15:16:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 3 Views🌐 WEB

Pi-hole FTL before 6.6 allows authenticated remote code execution via newline injection in upstream DNS.

Reporter	Title	Published	Views	Family All 9
GithubExploit	Exploit for CVE-2026-35517	14 Apr 202606:26	–	githubexploit
ATTACKERKB	CVE-2026-35517	7 Apr 202615:16	–	attackerkb
Circl	CVE-2026-35517	7 Apr 202617:29	–	circl
CNNVD	FTL 注入漏洞	7 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35517 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection	7 Apr 202615:16	–	cvelist
EUVD	EUVD-2026-19684	7 Apr 202615:16	–	euvd
NVD	CVE-2026-35517	7 Apr 202616:16	–	nvd
Positive Technologies	PT-2026-30865	3 Apr 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-35517 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection	7 Apr 202615:16	–	vulnrichment

NVD

Vulners

Node

pi-hole ftldnsRange6.0–6.5

[
  {
    "vendor": "pi-hole",
    "product": "FTL",
    "versions": [
      {
        "version": ">= 6.0, < 6.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

Parameter	Position	Path	Description	CWE
upstreams	request body	api/dns/upstream	Newline injection in dns.upstreams enables arbitrary dnsmasq directives, leading to RCE in FTLDNS when input is written to its config	CWE-93, CWE-78

28 Apr 2026 20:36Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.8

EPSS0.00127

SSVC