RCE in Pi-hole Llc Web
CVE-2025-34087
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.722 (98.8th percentile) — read the EPSS interpretation.
Affected products
- Pi-hole Llc Web — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/u… (exploit)
- pi-hole.net/ (product)
- github.com/pi-hole/web/releases/tag/v4.0 (vendor-advisory, patch)
- pulsesecurity.co.nz/advisories/pihole-v3.3-vulns (third-party-advisory, exploit)
- vulncheck.com/advisories/pihole-adminlte-whitelist-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34087?
- CVE-2025-34087 is a vulnerability in Pi-hole Llc Web, classified under OS Command Injection. Published 2025-07-03.
- Is CVE-2025-34087 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.