Ftl EUVD-2026-19711

Requires authenticated access to Pi-hole FTL API (versions 6.0-6.5). Attacker must inject newline characters into the dns.hostRecord configuration parameter to inject arbitrary dnsmasq directives and execute system commands.

The CVSS 8.8 score accurately reflects high severity with network attack vector (AV:N), low complexity (AC:L), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the low-privilege authentication requirement (PR:L) provides meaningful defense-in-depth for properly secured deployments. Real-world risk depends heavily on organizational exposure: Pi-hole instances with weak admin credentials, shared administrative access, or internet-exposed management interfaces face immediate high risk. The vulnerability is classified as Command Injection and RCE in tags, confirming the critical nature. No EPSS probability data is available, but the straightforward exploitation path and clear advisory from GitHub Security suggest medium-to-high likelihood of weaponization once details spread. The lack of confirmed active exploitation (no KEV listing) and absence of public exploit code provides a window for remediation before widespread attacks. Organizations should prioritize patching based on their Pi-hole deployment model: internet-facing or multi-tenant environments warrant emergency response, while isolated home networks with strong authentication present lower immediate risk.

An attacker with low-privilege authenticated access to a Pi-hole web interface navigates to the DNS host records configuration section and submits a malicious host record entry containing newline characters followed by dnsmasq directives such as 'conf-file=/tmp/malicious.conf' or direct exec statements. When FTL processes this configuration and reloads dnsmasq, the injected directives execute with the service's elevated privileges, allowing the attacker to execute arbitrary commands, establish persistence through cron jobs, exfiltrate network traffic data, or pivot to other systems on the network. In multi-user environments or deployments with compromised credentials, this provides a straightforward privilege escalation path from web interface access to full system compromise.