CVE-2026-35520

CVE-2026-35520 is a remote code execution vulnerability affecting Pi-hole FTL versions 6.0 through 6.5 in the DHCP lease time configuration parameter. An authenticated attacker can inject arbitrary dnsmasq configuration directives through newline character manipulation, allowing command execution on the affected system. The vulnerability has been remediated in version 6.6. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and valid authentication credentials. The attack requires no user interaction and impacts system confidentiality, integrity, and availability. The EPSS score of 0.0023 indicates this threat ranks higher than only 0.46 percent of known vulnerabilities, suggesting limited real-world prevalence. There is currently no evidence of active exploitation in the wild. The vulnerability has not been designated as a Known Exploited Vulnerability (KEV) by CISA, and community attention remains minimal with the threat classified as inactive on security tracking lists. Organizations running Pi-hole FTL should prioritize upgrading to version 6.6 or later to eliminate this risk.