CVE-2026-35521 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

High 8.8 Published 7 Apr 2026 Updated 7 Apr 2026

An authenticated attacker can inject dnsmasq directives via newline characters in DHCP hosts to execute arbitrary commands on the Pi-hole server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35521?

CVE-2026-35521 is a high-severity command injection vulnerability in pi-hole FTL, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Weakness: CWE-93, CWE-78

Which versions are affected by CVE-2026-35521?

It affects 1 product.

Products include Pi-Hole Ftldns.

How do I fix CVE-2026-35521?

No fix has been published for CVE-2026-35521 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-35521 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35521 exists.

Sources

Also known as GHSA-vfmq-jrx3-wv3c.