{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119334","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-10-29T20:44:30.285Z","datePublished":"2026-10-30T20:01:59.115Z","dateUpdated":"2026-10-30T20:01:59.115Z"},"containers":{"cna":{"title":"Pi-hole: file:// adlist read check and curl can resolve different files","problemTypes":[{"descriptions":[{"cweId":"CWE-59","lang":"en","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6"},{"name":"https://github.com/pi-hole/pi-hole/pull/6719","tags":["x_refsource_MISC"],"url":"https://github.com/pi-hole/pi-hole/pull/6719"},{"name":"https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971","tags":["x_refsource_MISC"],"url":"https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971"},{"name":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5","tags":["x_refsource_MISC"],"url":"https://github.com/pi-hole/pi-hole/releases/tag/v6.5"}],"affected":[{"vendor":"pi-hole","product":"pi-hole","versions":[{"version":"< 6.5","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-30T20:01:59.115Z"},"descriptions":[{"lang":"en","value":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5."}],"source":{"advisory":"GHSA-g63w-24cr-p3w6","discovery":"UNKNOWN"}}}}