{"id":"CVE-2026-119334","state":"PUBLISHED","title":"Pi-hole: file:// adlist read check and curl can resolve different files","description":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.","publishedAt":"2026-10-30T20:01:59.115Z","updatedAt":"2026-10-30T20:01:59.115Z","severity":{"score":2.2,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["pi-hole pi-hole"],"affected":[{"vendor":"pi-hole","product":"pi-hole","versions":[{"version":"< 6.5","status":"affected"}]}],"references":["https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6","https://github.com/pi-hole/pi-hole/pull/6719","https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971","https://github.com/pi-hole/pi-hole/releases/tag/v6.5"],"weaknesses":["CWE-59"],"ingestedAt":"2026-10-30T20:14:06.645Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/119xxx/CVE-2026-119334.json","commit":"d7f5c3fe206091a44e450f13bfe51dc81b8a7843","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119334","state":"PUBLISHED","datePublished":"2026-10-30T20:01:59.115Z","dateUpdated":"2026-10-30T20:01:59.115Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-10-29T20:44:30.285Z"},"containers":{"cna":{"title":"Pi-hole: file:// adlist read check and curl can resolve different files","descriptions":[{"lang":"en","value":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5."}],"affected":[{"vendor":"pi-hole","product":"pi-hole","versions":[{"version":"< 6.5","status":"affected"}]}],"references":[{"url":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6","name":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pi-hole/pi-hole/pull/6719","name":"https://github.com/pi-hole/pi-hole/pull/6719","tags":["x_refsource_MISC"]},{"url":"https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971","name":"https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971","tags":["x_refsource_MISC"]},{"url":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5","name":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","lang":"en","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-30T20:01:59.115Z"},"source":{"advisory":"GHSA-g63w-24cr-p3w6","discovery":"UNKNOWN"}}}}}