Pi-hole EUVD-2026-29295

Requires an attacker who already holds pihole-level privileges (PR:L) with the ability to write the files.pid value in the Pi-hole configuration, plus the ability to trigger a pihole-FTL service restart so systemd runs the ExecStartPre/ExecStopPost hooks as root. It targets default Pi-hole installations: if /root/.ssh/authorized_keys does NOT exist (default on fresh installs) only the ExecStartPre hook is needed; if it already exists, ExecStopPost deletes it first and the same restart runs both hooks in sequence. Limiting factors: exploitation is LOCAL only (AV:L, no remote/network path), needs prior pihole privilege rather than anonymous access, requires the affected version range (Core 6.0-6.4.1 / FTL before 6.6.1), and depends on the attacker being able to cause a service restart; the targeted path must lie outside the ProtectSystem=full read-only areas (e.g. /root).

Signals are mixed but coherent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C, 8.8 High) confirms this is a LOCAL, authenticated (PR:L) escalation, not remote - an attacker must already hold pihole-level access, so this is a second-stage/post-compromise issue rather than an initial-access vector. SSVC marks Technical Impact as total (full root) but Automatable as no and Exploitation as poc-level, and EPSS is 0.01% (2nd percentile), consistent with a targeted, hands-on-keyboard escalation rather than mass exploitation. It is NOT in CISA KEV. Net: genuinely serious where an attacker has already gained pihole privileges (total system compromise), but low likelihood of broad opportunistic exploitation. The CVSS vector and description agree (both local, config-driven), so no conflict to flag; the main caveat is that the SSVC 'poc' rating implies proof-of-concept knowledge exists even though no weaponized public exploit is confirmed here.

An attacker who has already compromised a service or account running under the pihole privilege (for example via a separate web/API foothold) edits the Pi-hole config so files.pid points at /root/.ssh/authorized_keys, then triggers an FTL restart. The root-run ExecStartPre hook recreates that path (and ExecStopPost first deletes it if it exists) under attacker influence, letting the attacker plant their own SSH key and log in as root. SSVC rates this as poc-level with total technical impact; no weaponized public exploit is confirmed at time of analysis.