CVE-2026-33765: Pi-hole Admin Interface RCE Vulnerability

CVE-2026-33765 Overview

A critical OS Command Injection vulnerability has been identified in the Pi-hole Admin Interface, the web-based management console for Pi-hole network-level ad and tracker blocking application. The vulnerability exists in the savesettings.php file where user-controlled input from the $_POST['webtheme'] parameter is concatenated directly into a system command executed via PHP's exec() function without any sanitization or validation. This allows remote attackers to inject and execute arbitrary system commands with elevated privileges.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands with root privileges on affected Pi-hole installations, potentially leading to complete system compromise.

Affected Products

• Pi-hole Admin Interface versions prior to 6.0
• Pi-hole Web Interface (pi-hole/web) all versions before 6.0

Discovery Timeline

• 2026-03-27 - CVE-2026-33765 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33765

Vulnerability Analysis

This vulnerability is classified as CWE-78 (OS Command Injection), a severe class of security flaws that allows attackers to execute arbitrary operating system commands on the host system. The root issue lies in the unsafe handling of user input in the Pi-hole Admin Interface's settings management functionality.

The vulnerable code path accepts user input through the webtheme POST parameter and passes it directly to a shell command without any input validation, sanitization, or escaping. What makes this vulnerability particularly dangerous is that the affected command is executed with sudo privileges, meaning any injected commands will run with root-level access to the underlying system.

Network-accessible with low attack complexity and requiring no user interaction, this vulnerability presents a significant risk to any Pi-hole installation with an exposed admin interface. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-controlled input ($_POST['webtheme']) into a system command executed via PHP's exec() function. The application fails to implement any of the standard defenses against command injection:

• No input validation against an allowlist of permitted values
• No sanitization or escaping of shell metacharacters
• No use of parameterized command execution functions
• Commands are executed with elevated sudo privileges, amplifying the impact

Attack Vector

The attack vector is network-based, targeting the savesettings.php endpoint in the Pi-hole Admin Interface. An attacker can craft a malicious HTTP POST request containing shell metacharacters and arbitrary commands in the webtheme parameter. Common injection techniques include using command separators such as semicolons (;), pipe operators (|), or command substitution syntax ($(command) or backticks) to append malicious commands to the legitimate pihole command.

Since the vulnerable code path executes with sudo privileges, successful exploitation grants the attacker root-level access to execute any system command, including downloading and executing malicious payloads, modifying system configurations, exfiltrating data, or establishing persistent backdoor access.

Detection Methods for CVE-2026-33765

Indicators of Compromise

• Unusual HTTP POST requests to /admin/savesettings.php containing shell metacharacters (;, |, $(), backticks) in the webtheme parameter
• Unexpected processes spawned as children of the web server process (e.g., Apache, nginx, lighttpd)
• Suspicious entries in web server access logs showing encoded or plaintext command injection attempts
• Unexpected network connections originating from the Pi-hole server
• Modified system files or new user accounts created outside normal administration

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block command injection patterns in POST parameters
• Monitor web server logs for requests containing shell metacharacters targeting the savesettings.php endpoint
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution chains from web server processes
• Configure intrusion detection systems (IDS) to alert on suspicious outbound connections from the Pi-hole host

Monitoring Recommendations

• Enable detailed logging for the Pi-hole Admin Interface and correlate with system-level process execution logs
• Monitor for unauthorized modifications to Pi-hole configuration files and system binaries
• Set up alerts for any new network listeners or outbound connections from the Pi-hole server
• Review sudo logs for unexpected command executions initiated by the web server user

How to Mitigate CVE-2026-33765

Immediate Actions Required

• Upgrade Pi-hole Admin Interface to version 6.0 or later immediately
• Restrict network access to the Pi-hole Admin Interface to trusted IP addresses only
• Implement authentication requirements for all administrative endpoints if not already configured
• Consider temporarily disabling the web admin interface until patching is complete

Patch Information

Version 6.0 of the Pi-hole Admin Interface patches this vulnerability by implementing proper input validation and sanitization for the webtheme parameter. Users should upgrade to version 6.0 or later as soon as possible.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to the Pi-hole Admin Interface using firewall rules to limit connections to trusted management networks only
• Place the Pi-hole Admin Interface behind a reverse proxy with authentication and request filtering capabilities
• Disable the savesettings.php functionality by restricting file permissions until the patch can be applied
• Implement network segmentation to isolate the Pi-hole server from sensitive network segments

# Example: Restrict admin interface access using iptables
# Allow only trusted management subnet to access the admin interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP