The Pi‑hole administration page accepts a user‑controlled "webtheme" value and passes it directly to the shell via PHP’s exec function. Because the input is not sanitized or validated, an attacker can inject arbitrary commands. Executed under sudo privileges, these commands run as root, allowing an attacker to gain full control of the host.

All installations of Pi‑hole’s web interface running versions older than 6.0 are affected. Files before this release contain the vulnerable savesettings.php logic, placing exposed systems at risk when the interface is reachable over a network.

The CVSS score of 8.9 reflects a high‑severity vulnerability. While an EPSS score is not available and the flaw is not catalogued in the CISA KEV list, the straightforward web‑based exploitation path means that an attacker with network access can readily trigger the injection using the theme submission form. Successful exploitation results in arbitrary root‑level command execution and full system compromise.