Pi Hole CVE-2026-33727

CVSS 6.4 reflects moderate severity with high impact but significant practical constraints. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates local attack only, high attack complexity, and high privilege requirement (pihole account), limiting opportunistic exploitation. However, this is NOT a low-risk issue despite the moderate CVSS score: the realistic threat model is a post-compromise scenario where an attacker has already gained code execution as the pihole account through a separate vulnerability (e.g., web UI RCE, FTL vulnerability, or supply-chain compromise). Given Pi-hole's deployment model as a network service handling DNS from potentially untrusted networks, such initial compromise vectors are plausible. The escalation to root is deterministic once the pihole account is compromised, making this a critical secondary exploit in a chained attack. KEV and POC status are not provided, indicating no confirmed active exploitation at time of analysis, but the clear code path and availability of vendor advisory should drive patching priority for Pi-hole 6.4 deployments.

An attacker compromises a Pi-hole instance via an initial vulnerability (e.g., remote code execution in the web dashboard or DNS service). The attacker gains code execution as the pihole account. The attacker then modifies /etc/pihole/versions to inject arbitrary shell commands or scripts. When a Pi-hole system component (running as root) sources this file as part of normal operation or a scheduled task, the attacker's code executes with root privileges, allowing complete system compromise. No public exploit code is required beyond basic file manipulation; the vulnerability is a simple but critical design flaw in configuration handling.