{"id":"CVE-2020-11108","aliases":["EUVD-2020-3466","GHSA-xm4h-5598-382p"],"status":"published","title":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary...","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.78262,"percentile":0.99584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2020-05-11T14:42:04Z","modified":"2026-10-24T10:30:20Z","exploits":[{"source":"pocgithub","id":"Frichetten/CVE-2020-11108-PoC","title":"Frichetten/CVE-2020-11108-PoC","date":"2020-04-04","url":"https://github.com/Frichetten/CVE-2020-11108-PoC"},{"source":"exploitdb","id":"EDB-48442","title":"Pi-hole \u003c 4.4 - Authenticated Remote Code Execution","type":"webapps","platform":"linux","date":"2020-05-10","url":"https://www.exploit-db.com/exploits/48442"},{"source":"exploitdb","id":"EDB-48443","title":"Pi-hole \u003c 4.4 - Authenticated Remote Code Execution / Privileges Escalation","type":"webapps","platform":"linux","date":"2020-05-10","url":"https://www.exploit-db.com/exploits/48443"},{"source":"metasploit","id":"exploit/unix/http/pihole_blocklist_exec","title":"Pi-Hole heisenbergCompensator Blocklist OS Command Execution","type":"exploit","platform":"PHP","date":"2020-05-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pihole_blocklist_exec"},{"source":"exploitdb","id":"EDB-48491","title":"Pi-Hole - heisenbergCompensator Blocklist OS Command Execution (Metasploit)","type":"remote","platform":"php","date":"2020-05-19","verified":true,"url":"https://www.exploit-db.com/exploits/48491"},{"source":"exploitdb","id":"EDB-48519","title":"Pi-hole 4.4.0 - Remote Code Execution (Authenticated)","type":"webapps","platform":"linux","date":"2020-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/48519"}],"products":[{"vendor":"pi-hole","product":"pi-hole"}],"references":[{"url":"https://frichetten.com/blog/cve-2020-11108-pihole-rce/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/Frichetten/CVE-2020-11108-PoC","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/157623/Pi-hole-4.4-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/157624/Pi-hole-4.4-Remote-Code-Execution-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/157748/Pi-Hole-heisenbergCompensator-Blocklist-OS-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/157839/Pi-hole-4.4.0-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11108"},{"url":"https://github.com/advisories/GHSA-xm4h-5598-382p"}],"sources":{"cve":[{"id":"CVE-2020-11108","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","status":"published","published":"2020-05-11T14:42:04Z","modified":"2024-08-04T11:21:14.619Z","updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-3466","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","status":"published","published":"2020-05-11T14:42:04Z","modified":"2024-08-04T11:21:14Z","updated_at":"2026-11-03T03:07:47.591202Z"}],"ghsa":[{"id":"GHSA-xm4h-5598-382p","title":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary...","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","status":"published","published":"2022-05-24T17:17:35Z","modified":"2023-01-29T05:02:36Z","updated_at":"2026-11-02T14:45:07.602262Z"}],"nvd":[{"id":"CVE-2020-11108","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","status":"published","published":"2020-05-11T15:15:11.353Z","modified":"2026-06-17T02:49:03.94Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-11108","description":"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.","status":"published","published":"2020-05-11T15:15:11.353Z","modified":"2026-10-24T10:30:20.831039297Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"}]}}