CVE-2025-34087

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34087

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

n authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.

References
Link Resource
https://github.com/pi-hole/web/releases/tag/v4.0 Release Notes
https://pi-hole.net/ Product
https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns Exploit Third Party Advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/pihole_whitelist_exec.rb Exploit
https://vulncheck.com/advisories/pihole-adminlte-whitelist-rce Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*
History

01 Oct 2025, 14:08

Type Values Removed Values Added
References () https://github.com/pi-hole/web/releases/tag/v4.0 - () https://github.com/pi-hole/web/releases/tag/v4.0 - Release Notes
References () https://pi-hole.net/ - () https://pi-hole.net/ - Product
References () https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns - () https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns - Exploit, Third Party Advisory
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/pihole_whitelist_exec.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/pihole_whitelist_exec.rb - Exploit
References () https://vulncheck.com/advisories/pihole-adminlte-whitelist-rce - () https://vulncheck.com/advisories/pihole-adminlte-whitelist-rce - Third Party Advisory
CPE cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*
First Time Pi-hole
Pi-hole pi-hole
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

08 Jul 2025, 16:19

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos autenticados en las versiones de Pi-hole hasta la 3.3. Al añadir un dominio a la lista de permitidos mediante la interfaz web, el parámetro de dominio no se depura correctamente, lo que permite a un atacante añadir comandos del sistema operativo a la cadena de dominio. Estos comandos se ejecutan en el sistema operativo subyacente con los privilegios del usuario del servicio Pi-hole. Este comportamiento ya existía en la interfaz AdminLTE heredada y se ha corregido en versiones posteriores.

03 Jul 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 20:15

Updated : 2025-10-01 14:08

NVD link : CVE-2025-34087

Mitre link : CVE-2025-34087

CVE.ORG link : CVE-2025-34087

JSON object : View

Products Affected

pi-hole

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')