A flaw in Pi‑hole version 6.4 permits a compromise of the low‑privilege pihole account to lead to code execution as root. The vulnerability arises because root‑run Pi‑hole scripts read attacker‑controlled entries from /etc/pihole/versions, which allows arbitrary code to be run with root privileges. This grants complete control over the host, including data theft, persistence, or further lateral movement.

Pi‑hole deployments running version 6.4 are affected. The issue is specific to the official Pi‑hole package, and any system using that package and not yet updated to 6.4.1 will remain vulnerable.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not in CISA’s Known Exploited Vulnerabilities catalog. However, the attack requires that an attacker already has the pihole user’s capabilities to be able to modify or inject files into /etc/pihole/versions, after which the vulnerability is trivially exploitable with root‑level impact. The attack vector is post‑compromise local, with no need for external network exposure.