CVE-2025-34087: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Pi-hole LLC Web
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.
AI Analysis
Technical Summary
This vulnerability (CVE-2025-34087) involves improper neutralization of special elements in OS commands (CWE-78) within Pi-hole's legacy AdminLTE web interface. When adding a domain to the allowlist, the input is not sanitized, enabling an authenticated user to inject and execute arbitrary OS commands with the Pi-hole service user's privileges. This issue is present in Pi-hole versions up to 3.3 and has been addressed in subsequent releases.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the host running Pi-hole with the privileges of the Pi-hole service user. This can lead to unauthorized system access, data compromise, or disruption of service. The CVSS 4.0 score of 9 indicates a critical severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.
Mitigation Recommendations
This vulnerability has been patched in versions of Pi-hole released after 3.3. Users should upgrade to the latest version of Pi-hole to remediate this issue. Since no official patch links are provided here, users should consult the Pi-hole LLC official advisories or release notes for the exact fixed versions and upgrade instructions. No additional mitigations are indicated by the vendor advisory.
CVE-2025-34087: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Pi-hole LLC Web
Description
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.
CVSS v4.0
Score 9.0critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-34087) involves improper neutralization of special elements in OS commands (CWE-78) within Pi-hole's legacy AdminLTE web interface. When adding a domain to the allowlist, the input is not sanitized, enabling an authenticated user to inject and execute arbitrary OS commands with the Pi-hole service user's privileges. This issue is present in Pi-hole versions up to 3.3 and has been addressed in subsequent releases.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the host running Pi-hole with the privileges of the Pi-hole service user. This can lead to unauthorized system access, data compromise, or disruption of service. The CVSS 4.0 score of 9 indicates a critical severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.
Mitigation Recommendations
This vulnerability has been patched in versions of Pi-hole released after 3.3. Users should upgrade to the latest version of Pi-hole to remediate this issue. Since no official patch links are provided here, users should consult the Pi-hole LLC official advisories or release notes for the exact fixed versions and upgrade instructions. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.551Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6866dff66f40f0eb729b624c
Added to database: 07/03/2025, 19:54:30 UTC
Last enriched: 05/21/2026, 12:05:51 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 190
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.