CVE-2026-35521

{
  "id": "CVE-2026-35521",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T16:16:28.693",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6."
    },
    {
      "lang": "es",
      "value": "FTLDNS (pihole-FTL) proporciona una API interactiva y también genera estadísticas para la interfaz web de Pi-hole. Desde la versión 6.0 hasta antes de la 6.6, el motor FTL de Pi-hole contiene una vulnerabilidad de ejecución remota de código (RCE) en el parámetro de configuración de hosts DHCP (dhcp.hosts). Esta vulnerabilidad permite a un atacante autenticado inyectar directivas de configuración arbitrarias de dnsmasq a través de caracteres de nueva línea, logrando finalmente la ejecución de comandos en el sistema subyacente. Esta vulnerabilidad está corregida en la 6.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pi-hole",
          "product": "FTL",
          "versions": [
            {
              "version": ">= 6.0, < 6.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-07T18:21:35.967672Z",
          "id": "CVE-2026-35521",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndIncluding": "6.5",
              "matchCriteriaId": "8C927FF0-74A4-4F13-95A8-E80C5E80F607"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}