Ftl CVE-2026-35491

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) indicates a local attack vector requiring low privilege (PR:L) with low complexity and no user interaction. The integrity impact is high (I:H) and availability impact is low (A:L), reflecting the ability to overwrite configuration. The local-only attack vector significantly constrains real-world risk, as an attacker must already have local system access or a valid API credential. However, the low authentication barrier (CLI sessions are intended as less-privileged credentials) and high integrity impact create meaningful risk in multi-tenant or shared-access Pi-hole deployments. The EPSS score and KEV status are not provided, preventing comparison against exploitation prevalence; however, the low attack vector and requirement for existing authentication suggest this is primarily a privilege-escalation concern rather than an entry vector. In environments where multiple users share Pi-hole access with CLI credentials, this represents a moderate-to-high priority due to authorization bypass enabling configuration tampering.

An attacker with a valid CLI API credential (obtained through phishing, credential reuse, or shared system access) sends a Teleporter archive upload request to the /api/teleporter endpoint. Because the endpoint does not validate that the session is restricted to read-only operations, the archive is processed and the configuration is overwritten, allowing the attacker to modify DNS settings, change admin credentials, disable logging, or inject malicious upstream DNS servers-all without being able to mutate configuration through the properly-secured /api/config endpoint. No public exploit code is documented, but the straightforward nature of the authorization bypass (missing validation on a single endpoint) makes exploitation trivial once a CLI credential is available.