Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Pi-hole / v6.5

Pi-hole v6.5

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-10-17T11:36:23Z · GitHub release

Summary of changes

## Security This release fixes the following security advisories (credit to the reporters named): High - GHSA-cf36-4hhc-8398 (CVSS 7.8): command execution via a crafted PID. Reported by @abdoghazy2015. - GHSA-xch2-4qxw-g5vj (CVSS 7.8): root following a symlink when writing the version file. Reported by @keithlinneman and @KimiSecurityTeam. - GHSA-j8vh-6fp9-cjcx (CVSS 7.8): /opt/pihole is now read-only for the FTL service. Reported by @keithlinneman. - GHSA-mff6-cjc4-5wq9 (CVSS 7.3): root writing to config-supplied paths. Reported by @KimiSecurityTeam, @keithlinneman and @Pedromdsn. Low - GHSA-g63w-24cr-p3w6 (CVSS 2.2): the file:// adlist read check and curl could resolve different files. Local lists are now read as the user whose access was checked. ## What's Changed - Stop double-rotating logs now that pihole is in /etc/logrotate.d. …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.