CVE-2026-35517

OVERVIEW: CVE-2026-35517 is a Remote Code Execution vulnerability affecting Pi-hole FTL versions 6.0 through 6.5. The flaw exists in the upstream DNS servers configuration parameter where authenticated attackers can inject arbitrary dnsmasq configuration directives using newline characters to achieve command execution on the host system. The vulnerability has been remediated in version 6.6. SEVERITY: The vulnerability carries a CVSS score of 8.8 (HIGH) with a network attack vector, low complexity, and no user interaction required. While authentication is required, the impact is severe, allowing attackers to gain complete control over system confidentiality, integrity, and availability. The exploit requires only valid credentials to trigger. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities list, and community attention remains minimal as indicated by the inactive status on security tracking platforms. The EPSS score of 0.00077 suggests low current exploitation probability, though organizations should prioritize patching to version 6.6 to mitigate this authenticated RCE risk.