CVE-2026-35518

OVERVIEW CVE-2026-35518 is a Remote Code Execution vulnerability affecting Pi-hole FTL (FTLDNS) versions 6.0 through 6.5. The vulnerability exists in the DNS CNAME records configuration parameter, where an authenticated attacker can inject arbitrary dnsmasq configuration directives using newline characters to achieve command execution on the underlying system. The issue has been remediated in version 6.6. SEVERITY This vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and low privileges. The attack requires prior authentication, making it accessible to authorized users or those with compromised credentials. However, the impact is severe, with potential for complete system compromise including confidentiality, integrity, and availability breaches. The FAUCET risk score of 42.0/100 indicates moderate concern within the threat landscape. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's inactive status on the KEV catalog and low EPSS score of 0.002270000. The relatively low community attention and lack of public exploit code suggest limited immediate threat; however, organizations running affected Pi-hole FTL versions should prioritize patching to version 6.6 to eliminate the attack surface for authenticated threat actors.