CVE-2026-119334

    Dashboard / Vulnerabilities / CVE-2026-119334

    CVE-2026-119334

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: Pi-hole: file:// adlist read check and curl can resolve different files

    Details: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.

    References: https://github.com/pi-hole/pi-hole/releases/tag/v6.5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119334.json, https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6, https://nvd.nist.gov/vuln/detail/CVE-2026-119334, https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971, https://github.com/pi-hole/pi-hole/pull/6719

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f503a65d3a07cb71fd931389f1d3babf718249aa

    Affected versions

    v6.4.3
    v6.4.2
    v6.4.1
    v6.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119334 | CVE-DB