CVE-2026-35521

OVERVIEW: CVE-2026-35521 is a Remote Code Execution vulnerability affecting Pi-hole FTL versions 6.0 through 6.5. The vulnerability exists in the DHCP hosts configuration parameter where an authenticated attacker can inject arbitrary dnsmasq configuration directives using newline characters, leading to command execution on affected systems. The issue has been patched in version 6.6. SEVERITY: The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and valid credentials. No user interaction is required, and successful exploitation results in complete compromise of system confidentiality, integrity, and availability. The FAUCET Risk Score of 42/100 indicates moderate overall risk when considering additional contextual factors. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and community attention is currently minimal as indicated by the low EPSS score of 0.002. Organizations should prioritize patching to version 6.6 to eliminate this attack vector, particularly in environments where administrative access to the Pi-hole interface is not properly restricted.