CVE-2020-8816 Pi-Hole AdminLTE Remote Code Execution
Privileged dashboard users can execute arbitrary code via crafted DHCP static leases in Pi-hole Web Admin.
- Exploited in the wild
- Since 10 Dec 2021
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8816?
CVE-2020-8816 is a critical command injection vulnerability in n/a, published on 29 May 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Weakness: CWE-78
Which versions are affected by CVE-2020-8816?
It affects 1 product.
Products include Pi-Hole Pi-Hole.
How do I fix CVE-2020-8816?
No fix has been published for CVE-2020-8816 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Jun 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-8816 being exploited?
Yes. Attackers have exploited CVE-2020-8816 in the wild since at least 10 Dec 2021.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 4 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
- CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
- CVE-2020-11108 File upload in n/a
- CVE-2019-13051 Pi-Hole 4.3 allows Command Injection.
- CVE-2024-34361 Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
Sources
Also known as GHSA-v4fw-xc8h-7p52.