CVE-2026-33765 is an OS command injection flaw in the Pi-hole Admin Interface. NVD scores it 9.8. Versions before 6.0 are affected, and the advisory says up to v5.21. Upgrade to Pi-hole 6.0 or later. The advisory describes it as a version 5 issue, and the fix is the 6.0 rewrite.
What's affected
The advisory title marks this as a V5 issue, with affected versions up to v5.21 and the patched version v6.0. The flaw is in savesettings.php, where the webtheme POST parameter is concatenated into a command run through PHP's exec(). The advisory says the command runs with sudo, so injected commands would likely run as root.
How to check if you're exposed
pihole -v
If the web interface reports a version in the 5.x line, you are on the affected code. Check who can reach the admin interface: the settings page is normally behind login, and the record does not say otherwise, so treat any network that can reach it as in scope.
What to do now
- Upgrade to Pi-hole 6.0 or later.
- Keep the admin interface off the public internet and limit it to trusted networks.
- Use a strong admin password and rotate it after upgrading.
- Check the host for unexpected files or users if the interface was ever exposed.
Why it matters
The record uses CWE-78, OS command injection. User input was placed into a shell command with no validation. The fix is to allow only known values, such as a list of valid theme names, and avoid building shell strings. The record is not marked as exploited in the wild and is not in CISA KEV.
This is an old pattern with a simple fix. A setting such as a theme name should come from a fixed list of allowed values, so the code can reject anything else before it gets near a shell. If you run an older Pi-hole for a reason, put it behind a network boundary and plan the move to 6.0, since the version 5 line is the one the advisory marks as affected.
Quick check
Which version fixes it?
Pi-hole web interface v6.0, per the advisory.
Sources
Last reviewed: 19 October 2026.
