CVE-2024-34361: Pi-Hole

High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days.

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Affected products

• Pi-hole Pi-Hole: before 5.18.3 (fixed in 5.18.3)

Published 2024-07-05. Last modified 2026-06-17.