Dashboard / CVE-2025-34087

CVE-2025-34087

CRITICAL
INFO Priority: 0.63 BB Relevance: 69/100
Published: 2025-07-03 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: High
VI: High
VA: High

Description

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Pi-hole LLC Web 0

References & Advisories (5)

https://github.com/pi-hole/web/releases/tag/v4.0
vendor-advisory patch release-notes

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS — Exploitation Probability

7.04%
Raw Score 0.070390
Percentile 94.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.07039
2026-11-12
0.07039
2026-11-10
0.07039
2026-11-09
0.07039
2026-11-08
0.07039

Intelligence Sources

mitre ref →

External Links