What's Changed (Docker Specific)
- Schedule logrotate directly in the container crontab by @PromoFaux in #2093
- Drop the no-op config read at the start of ftl_config by @010011110 in #2094
- ci: remove layer cache from image builds by @PromoFaux in #2095
- Depend on
setprivinstead ofsudoby @darkexplosiveqwx in #2097 - Build the scheduled nightly image from
developmentby @DL6ER in #2099 - Development -> master by @PromoFaux in #2101
Full Changelog: 2026.10.1...2026.11.0
Security Fixes
This release includes FTL v6.9 and Core v6.6, which fix 11 security advisories.
- pi-hole/FTL/security/advisories/GHSA-pj9m-9623-2g75 — validate_filepath regression leads to admin RCE, fixed in both FTL and Core (High) reported by Pedromdsn
- pi-hole/pi-hole/security/advisories/GHSA-wp3p-45h3-2v82 — Incomplete fix for symlink-following in /etc/pihole: root still clobbers/chowns attacker-chosen files via the installer (High) found by cerodah, reported by pmagayon
- pi-hole/pi-hole/security/advisories/GHSA-5w4v-f65m-323f — Root follows symlinks and config-supplied paths in /etc/pihole during the macvendor.db download, pihole checkout and pihole uninstall (High) reported by pmagayon
- pi-hole/pi-hole/security/advisories/GHSA-jvg9-fm8x-2jqq — piholeDebug.sh follows symlinks in pihole-owned directories (High) found by wyx98765, reported by pmagayon
- pi-hole/pi-hole/security/advisories/GHSA-qfq3-88xg-765w — pihole -d debug log and tricorder upload include the web password hash, app password hash and TOTP secret (Moderate) reported by pmagayon
- pi-hole/FTL/security/advisories/GHSA-x6xh-vxcm-g8rm — Limited sessions (app-password without app_sudo, and CLI) can enumerate all sessions and terminate any session (Low) reported by gudangkantong
- pi-hole/FTL/security/advisories/GHSA-87wp-wm3p-8cxm — webserver.acl IPv4 entries never match IPv4 clients on a dual-stack webserver.port listener (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-cg4p-5r3r-m54p — a password change through pihole-FTL --config is silently undone by a concurrent API config write (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-fj2f-pgf2-j888 — queries recorded at misc.privacylevel 3 can reach the long-term database when the level is lowered (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-9mh9-95wj-4w4q — authenticated crash: the dnsmasq cache is walked from a web worker while a hosts reload frees the old hash table (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-9hh4-j8jf-6c96 — Teleporter v5 import frees a live config array in place while API readers copy it (use-after-free) (Low) reported by 010011110
Component Releases
Release notes for the components included in this image: