CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS 通过换行符注入实现远程代码执行 摘要 Pi-hole 的 FTLDNS 引擎（6.0 至 6.5 版本）中存在一个远程代码执行 漏洞，允许已认证的攻击者通过向 dns.upstreams API 参数中嵌入换行符 （\n）来注入任意的 dnsmasq 配置指令。由于 dnsmasq 支持可执行 shell 命令的指令，这种换行符注入可直接转化为在主机系统上执行任意命令 。 这不仅仅是一个单一漏洞，而是一类影响五个不同配置参数 的注入问题，全部已在 FTL v6.6 中一并修复。 目录 快速概览 什么是 Pi-hole...

CVE-2026-35491

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature webserver.api.clipw that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config...

Exploit for CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS Remote Code Execution via Newl...

CVE-2026-35518

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DNS CNAME records configuration parameter dns.cnameRecords. This vulnerability allows a...

PT-2026-30865

Name of the Vulnerable Software and Affected Versions FTLDNS pihole-FTL versions 6.0 through 6.5 Description The Pi-hole FTL engine contains a Remote Code Execution RCE issue in the upstream DNS servers configuration parameter dns.upstreams. An authenticated attacker can inject arbitrary dnsmasq...