CRITICAL🇵🇱 Wersja polska

CVE-2025-34087

CVSS 9.0v4.0pub. 2025-07-03upd. 2025-10-01

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Pi Hole

    APP
    Pi-Hole
    ≤ 3.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2020-8816HIGH7.2⚠ KEVten sam produkt

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHC...

CVE-2024-44069HIGH7.5ten sam produkt

Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of th...

CVE-2024-34361HIGH8.5ten sam produkt

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side softw...

CVE-2024-28247HIGH7.6ten sam produkt

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-s...

CVE-2021-32706HIGH7.6ten sam produkt

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statis...