Security: pi-hole/FTL
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Remote Code Execution (RCE) via CivetWeb Configuration InjectionGHSA-8j7w-m3cr-6q6x published
Jul 6, 2026 by PromoFauxHigh -
Log injection in webserver access-log writer chains to remote code execution via Lua-server-page evaluationGHSA-g7v8-8q8f-hprp published
Jul 6, 2026 by PromoFauxModerate -
Session Expiration BypassGHSA-w8cr-2cwg-92cg published
Jul 6, 2026 by PromoFauxHigh -
CRLF Injection / HTTP Header Injection via Group NameGHSA-r5vh-5q82-jg7q published
Jul 6, 2026 by PromoFauxLow -
Unauthenticated Session Hijacking via Race Condition on Global Session BufferGHSA-9ff5-f3v5-2xc7 published
May 16, 2026 by PromoFauxHigh -
Newline Injection → RCE via dnsmasq dhcp-scriptGHSA-9cqv-839p-gpq2 published
Apr 24, 2026 by PromoFauxHigh -
Authorization bypass: CLI API sessions can import Teleporter archives and modify configurationGHSA-r7g8-3fj7-m5qq published
Apr 3, 2026 by PromoFauxModerate -
Remote Code Execution (RCE) via dns.upstreams Newline InjectionGHSA-23w8-7333-p9fj published
Apr 3, 2026 by PromoFauxHigh -
Remote Code Execution (RCE) via dhcp.leaseTime Newline InjectionGHSA-fqv2-qhfh-ghcj published
Apr 3, 2026 by PromoFauxHigh -
Remote Code Execution (RCE) via dns.cnameRecords Newline InjectionGHSA-28g5-gg88-wh5m published
Apr 3, 2026 by PromoFauxHigh