CVE-2026-50130

HighCVSS 8.8/10Last modified Jul 30, 2026

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-282

Affected software

Vendor	Product	Versions
pi-hole	pi-hole	>= 6.0.0, < 6.4.3

References

https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89Patch
https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3Product, Release Notes
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrwwExploit, Mitigation, Vendor Advisory
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrwwExploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-501318.6Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network CVE-2026-501327.3Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth CVE-2026-501336.1Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media CVE-2026-501345.8Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, bu CVE-2026-501355.5Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead o CVE-2026-501365.3Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 CVE-2026-501379.4Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and CVE-2026-501388.1goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction CVE-2026-501395.9goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, rel CVE-2026-50145.3A vulnerability was found in elecV2 elecV2P up to 3.8.3. The affected element is the function path.join of the file /log/ of the component W CVE-2026-501417.1Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed a CVE-2026-501427.5libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_