Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-50130Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

High 8.8

In plain English

A high-severity security flaw in pi-hole from pi-hole. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 82.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Affected products (as reported)

Vendor	Product	Versions
pi-hole	pi-hole	>= 6.0.0, < 6.4.3

Weakness: CWE-282 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww x_refsource_CONFIRM
https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89 x_refsource_MISC
https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3 x_refsource_MISC