High severity · published Apr 7, 2026
CVE-2026-35521
Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FT
FTL · pi-hole
>= 6.0, < 6.6 · source: vendor
FT
Ftldns · Pi-hole
6.0 through 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35521
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35521
Exploit
https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c
More from FTL
8.8
CVE-2026-44693
Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer
8.8
CVE-2026-39849
Pi-hole FTL remote code execution via newline injection in dns.interface configuration
8.8
CVE-2026-35520
Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
8.8
CVE-2026-35519
Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
8.8
CVE-2026-35518
Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection