Pi‑hole version 6.4 contains a local privilege‑escalation vulnerability that allows an attacker who has already gained code execution as the low‑privileged "pihole" user to replace or modify the file /etc/pihole/versions. This file is read and sourced by scripts that run as root, so the attacker can execute arbitrary code with root privileges. The weakness is a classic privilege‑escalation scenario, identified as CWE‑269. The impact is elevation of an attacker from a non‑root user to full root access on the system, enabling total control over the device and its network traffic.

Vendors and products affected are Pi‑hole, the network‑level ad‑blocking application written for Linux. Only the 6.4 release series is vulnerable; the issue is fixed in 6.4.1. Any installation of Pi‑hole 6.4 that has not been upgraded is at risk. Devices running this version on routers, Raspberry Pi, or other embedded Linux platforms could be compromised.

The CVSS score of 6.4 indicates a moderate to high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the vulnerability requires a prior local compromise to place malicious content into /etc/pihole/versions, it is not exploitable from the network alone. However, once an attacker has local code execution as the "pihole" user, escalation to root is almost immediate and straightforward, making the risk significant in a post-compromise scenario.