CVE-2021-32706

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
pi-hole	AdminLTE	< 5.5.1

References

https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1Release Notes, Third Party Advisory
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259Exploit, Third Party Advisory
https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1Release Notes, Third Party Advisory
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259Exploit, Third Party Advisory

Timeline

Published: Aug 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327074.3Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images i CVE-2021-327088.1Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. CVE-2021-327094.9Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to up CVE-2021-32714.8PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all acti CVE-2021-327107.5Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to upd CVE-2021-327117.5Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only CVE-2021-327125.3Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. User CVE-2021-327134.8Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerabil CVE-2021-327149.1hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an intege CVE-2021-327155.3hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length CVE-2021-327164.9Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an as CVE-2021-327177.5Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers w