CVE-2025-34087

CVE-2025-34087: An authenticated command-injection in Pi-hole’s web interface (legacy AdminLTE) exists up to version 3.3, where unsanitized domain input added to the allowlist can be exploited to execute OS commands as the Pi-hole service user. The issue is tied to the legacy AdminLTE interface a...

CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...