- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 43
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 1
- https://pi-hole.net
Products and areas 10
- Blocklist and gravity handling: fetching remote lists, parsing them and building the blocking database from data whoever publishes the list controls
- Conditional forwarding and the upstream resolver paths, including DoH or DoT where an installation adds it
- Docker packaging and the container's default configuration, the way a large share of installations actually run
- FTL, the C daemon: the forked dnsmasq core, DNS query handling, DHCP handling and the blocking logic layered on top
- The admin web interface and its templates, where query data collected from the network is rendered back to an operator
- The DHCP server function, which Pi-hole commonly runs in place of the router's own
- The installer and update scripts, which run as root and fetch code over the network
- The organisation's policy welcomes all responsible disclosures and names one email address for them. It draws no boundary beyond ruling out public issues, so the whole product is in
- The query database and statistics engine, including everything written to and read back from long-term storage
- The web API in full, covering authentication, session handling, every endpoint and every setting a caller can change
Out of scope (5)
- A user deliberately exposing the admin interface to the internet, absent a defect in the interface itself
- Blocklist content, including a list that blocks or fails to block a given domain
- Public GitHub issues filed as security reports, which the policy rules out by name
- Third-party plugins and community scripts that are not part of the Pi-hole repositories
- Unmodified upstream dnsmasq code, which belongs to that project's own maintainer and reporting channel
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Email the address on the policy page , the address the organisation's policy names, or use GitHub private vulnerability reporting, which is enabled on both pi-hole/pi-hole and pi-hole/FTL
-
Do not open a public issue. The policy rules that out directly, and a working sinkhole exploit posted publicly reaches a very large installed base within hours
-
Look for the policy at the organisation level. Neither main repository carries a SECURITY.md; the real one is in pi-hole/.github
-
Say which component you hit: the FTL daemon in C, the web interface, the API, or the installer scripts.
-
Separate Pi-hole's dnsmasq fork from upstream dnsmasq.
-
State whether the finding needs an authenticated admin session.
-
Hold detail until the advisory is public and leave home installations time to pick up the update.
Not accepted
-
Unmodified upstream dnsmasq code
-
A user deliberately exposing the admin interface to the internet, absent a defect in the interface itself
-
Blocklist content, including a list that blocks or fails to block a given domain
-
Public GitHub issues filed as security reports
-
Third-party plugins and community scripts that are not part of the Pi-hole repositories
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-50130 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firsta | High 8.8 | 14 Jul 2026 |
| CVE-2026-39849 | Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set (the default for many deployments | High 8.7 | 5 May 2026 |
| CVE-2026-35520 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline charact | High 8.8 | 7 Apr 2026 |
| CVE-2026-35521 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ulti | High 8.8 | 7 Apr 2026 |
| CVE-2026-35517 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline cha | High 8.8 | 7 Apr 2026 |
| CVE-2026-35518 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline cha | High 8.8 | 7 Apr 2026 |
| CVE-2026-35519 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline charact | High 8.8 | 7 Apr 2026 |
| CVE-2026-35491 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter import | Medium 6.1 | 7 Apr 2026 |
| CVE-2026-33405 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the serv | Low 3.1 | 6 Apr 2026 |
| CVE-2026-33727 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct interactive-login issue. However, nologin does not prevent code from running as UID pihole if a Pi-hole co | Medium 6.4 | 6 Apr 2026 |
| CVE-2026-33406 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. | Medium 5.4 | 6 Apr 2026 |
| CVE-2026-33403 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment wit | Medium 6.1 | 6 Apr 2026 |
| CVE-2026-33404 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters vi | Low 3.4 | 6 Apr 2026 |
| CVE-2026-33765 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the in | High 8.9 | 27 Mar 2026 |
| CVE-2026-26952 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. | Medium 5.4 | 19 Feb 2026 |
| CVE-2026-26953 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits t | Medium 5.4 | 19 Feb 2026 |
| CVE-2025-59151 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carr | High 8.2 | 27 Oct 2025 |
| CVE-2025-53533 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An | Medium 5.1 | 27 Oct 2025 |
| CVE-2025-32785 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when | Low 2.0 | 27 Oct 2025 |
| CVE-2025-34087 | An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present i | Critical 9.0 | 3 Jul 2025 |
| CVE-2024-44069 | Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear. | High 7.5 | 19 Aug 2024 |
| CVE-2024-34361 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a | High 8.5 | 5 Jul 2024 |
| CVE-2024-28247 | The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" beg | High 7.6 | 27 Mar 2024 |
| CVE-2023-23614 | Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exp | High 8.8 | 26 Jan 2023 |
| CVE-2022-23513 | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/ | Medium 5.3 | 23 Dec 2022 |
| CVE-2022-31029 | AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the ris | Medium 5.9 | 7 Jul 2022 |
| CVE-2021-41175 | Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8. | High 7.3 | 26 Oct 2021 |
| CVE-2021-3811 | adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 17 Sep 2021 |
| CVE-2021-3812 | adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 17 Sep 2021 |
| CVE-2021-3706 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag | High 7.5 | 15 Sep 2021 |
| CVE-2021-32793 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload | Medium 5.7 | 4 Aug 2021 |
| CVE-2021-32706 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowin | High 7.6 | 4 Aug 2021 |
| CVE-2021-29448 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details. | High 7.6 | 15 Apr 2021 |
| CVE-2021-29449 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details. | Medium 6.3 | 14 Apr 2021 |
| CVE-2020-35591 | Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session. | Medium 5.4 | 18 Feb 2021 |
| CVE-2020-35592 | Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie. | Medium 5.4 | 18 Feb 2021 |
| CVE-2020-35659 | The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page. | Medium 6.1 | 24 Dec 2020 |
| CVE-2020-12620 | Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address). | High 7.8 | 30 Jul 2020 |
| CVE-2020-14162 | An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command. | High 7.8 | 30 Jul 2020 |
| CVE-2020-14971 | Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and | High 7.8 | 23 Jun 2020 |
| CVE-2020-8816 | Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. | High 7.2 | 29 May 2020 |
| CVE-2020-11108 | The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh. | High 8.8 | 11 May 2020 |
| CVE-2019-13051 | Pi-Hole 4.3 allows Command Injection. | High 8.8 | 9 Oct 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 13 Last 12 months Remote code execution 40 % Access control 25 % DNS/packet parsing 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Pi-hole is the DNS sinkhole people put on their home network to block ads and tracking, and FTL is the daemon underneath it: a fork of dnsmasq with a query database and an authenticated web API added. It sits in the resolution path for every device in the house, which makes it a position rather than an application. Thirteen advisories landed in the last twelve months and many are remote code execution, including the CVE-2026-35517 series. The forked dnsmasq core brings its own long parsing history along with it, and the web layer is additional. Nobody pays for findings here. sorona.xyz pays you directly on qualified, reproduced findings. In scope The organisation's policy welcomes all responsible disclosures and names one email address for them. It draws no boundary beyond ruling out public issues, so the whole product is in FTL, the C daemon: the forked dnsmasq core, DNS query handling, DHCP handling and the blocking logic layered on top The query database and statistics engine, including everything written to and read back from long-term storage The web API in full, covering authentication, session handling, every endpoint and every setting a caller can change The admin web interface and its templates, where query data collected from the network is rendered back to an operator Blocklist and gravity handling: fetching remote lists, parsing them and building the blocking database from data whoever publishes the list controls The installer and update scripts, which run as root and fetch code over the network The DHCP server function, which Pi-hole commonly runs in place of the router's own Conditional forwarding and the upstream resolver paths, including DoH or DoT where an installation adds it Docker packaging and the container's default configuration, the way a large share of installations actually run Out of scope Unmodified upstream dnsmasq code, which belongs to that project's own maintainer and reporting channel A user deliberately exposing the admin interface to the internet, absent a defect in the interface itself Blocklist content, including a list that blocks or fails to block a given domain Public GitHub issues filed as security reports, which the policy rules out by name Third-party plugins and community scripts that are not part of the Pi-hole repositories Most-valued findings Unauthenticated remote code execution on the FTL daemon or through the web API. Several of the thirteen recent advisories are RCE, including CVE-2026-65963 and the CVE-2026-35517 through -35521 cluster, with CVE-2026-39849 and CVE-2026-44693 in the same twelve months Anything reachable from a DNS query alone. Every device on the network can send one, including the ones nobody trusts, and the sinkhole answers before anything else does Authentication and session handling on the web API, where a bypass converts a foothold on the guest network into administrative control of the household's DNS Injection into the query log or statistics path, where an attacker-chosen hostname is stored and later rendered back in the admin interface Blocklist and gravity processing, since that path fetches and parses remote data on a schedule with root behind it Defects in the forked dnsmasq core that upstream does not have, introduced by Pi-hole's own changes to that code Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address the organisation's policy names, or use GitHub private vulnerability reporting, which is enabled on both pi-hole/pi-hole and pi-hole/FTL Do not open a public issue. The policy rules that out directly, and a working sinkhole exploit posted publicly reaches a very large installed base within hours Look for the policy at the organisation level. Neither main repository carries a SECURITY.md; the real one is in pi-hole/.github Say which component you hit: the FTL daemon in C, the web interface, the API, or the installer scripts. They are separate repositories in different languages with different reviewers Separate Pi-hole's dnsmasq fork from upstream dnsmasq. A defect in unmodified upstream code belongs to that project's maintainer, and a defect in the fork or in how FTL drives it belongs here State whether the finding needs an authenticated admin session. Much of the recent record is post-authentication, and an unauthenticated equivalent is worth far more Disclosure Coordinated by email or GitHub private vulnerability reporting with the Pi-hole team, then published as a GitHub Security Advisory alongside a fixed release. The cadence is high, with thirteen advisories in the last twelve months and several arriving in clusters, so a report tends to land in a batch rather than alone. Hold detail until the advisory is public and leave home installations time to pick up the update. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability