CVE-2021-29448

Pi-hole exposes a Stored XSS vulnerability in the Admin portal (Web Interface) of Pi-hole, described across multiple sources. The issue is a stored DOM/XSS flaw in the AdminLTE-based interface that can be triggered by an attacker with network access to the DNS server. Affected is Pi-hole’s admin/...

CVE-2026-35520

Pi-hole FTLDNS (pihole-FTL) versions 6.0 through

CVE-2026-35518

Pi-hole FTL (FTLDNS) from 6.0 up to before 6.6 is vulnerable to Remote Code Execution via newline injection in the DNS CNAME records configuration parameter (dns.cnameRecords). An authenticated attacker can inject arbitrary dnsmasq directives, enabling command execution on the host. The issue is ...

CVE-2026-35521

CVE-2026-35521 impact (Pi-hole FTL/FTLDNS). From 6.0 up to but not including 6.6, Pi-hole’s FTL engine contained a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). An authenticated attacker could inject arbitrary dnsmasq configuration directives by...

CVE-2026-35517

Pi-hole FTL (FTLDNS) contains a Remote Code Execution flaw from 6.0 up to before 6.6 in the upstream DNS servers configuration (dns.upstreams). An authenticated attacker can inject arbitrary dnsmasq directives via newline characters, leading to command execution on the host. The issue is fixed in...

CVE-2026-39849

Pi-hole FTL before version 6.6.1 is vulnerable to a newline-injection in the dns.interface configuration field. The field accepts newlines without validation, allowing a network-adjacent attacker to inject arbitrary directives into the generated dnsmasq configuration. On systems with no admin pas...

CVE-2026-35491

Pi-hole FTL (FTLDNS) from 6.0 to before 6.6 exposes a vulnerability where CLI API sessions (webserver.api.cli_pw) could import Teleporter archives via the /api/teleporter endpoint and overwrite configuration, despite /api/config blocking CLI sessions. This creates an authorization bypass that let...

CVE-2026-35519

CVE-2026-35519 affects Pi-hole FTL (FTLDNS). From 6.0 up to before 6.6, an authenticated attacker could inject arbitrary dnsmasq directives into the dns.hostRecord parameter via newline characters, leading to remote code execution on the host. The vulnerability is fixed in version 6.6. Exploitati...