CVE-2021-32706 (Authenticated) Remote Code Execution Possible in Web Interface 5.5
Authenticated attackers can execute arbitrary code, list directories, and overwrite files via a regex flaw in the domain validation filter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32706?
CVE-2021-32706 is a high-severity code injection vulnerability in pi-hole AdminLTE, published on 4 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
Weakness: CWE-94
Which versions are affected by CVE-2021-32706?
It affects 1 product.
Products include Pi-Hole Pi-Hole.
How do I fix CVE-2021-32706?
No fix has been published for CVE-2021-32706 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-32706 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32706 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in pi-hole AdminLTE
- CVE-2020-8816 Pi-Hole AdminLTE Remote Code Execution
- CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
- CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
- CVE-2020-11108 File upload in n/a
- CVE-2019-13051 Pi-Hole 4.3 allows Command Injection.
Sources
Also known as GHSA-5cm9-6p3m-v259.