CVE-2026-119334 Pi-hole: file:// adlist read check and curl can resolve different files
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119334?
CVE-2026-119334 is a low-severity vulnerability in pi-hole, published on 30 Oct 2026.
Official description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
Weakness: CWE-59
Which versions are affected by CVE-2026-119334?
How do I fix CVE-2026-119334?
No fix has been published for CVE-2026-119334 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119334 being exploited?
There is no known exploitation of CVE-2026-119334 in the wild and no public exploit code.
Sources
Also known as GHSA-g63w-24cr-p3w6.