FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contai…

CVE-2026-35519 affects Pi-hole FTL DNS service versions 6.0 to before 6.6. The vulnerability exists in the DNS host record configuration parameter (dns.hostRecord) where authenticated attackers can inject arbitrary dnsmasq configuration directives through newline characters. This injection leads to remote code execution on the underlying system. The vulnerability has been patched in version 6.6. Pi-hole FTL provides an interactive API and generates statistics for Pi-hole's web interface, making this a significant security issue for DNS filtering systems.