The Pi‑hole Admin Interface contains a flaw in savesettings.php that allows an attacker to control the $_POST['webtheme'] parameter. That value is concatenated directly into a shell command executed by PHP’s exec() function. Because no sanitization or validation occurs, an attacker can inject arbitrary commands, and since the command runs under sudo, the injected code executes with root privileges. This can lead to full compromise of the host, including data theft, changes to network configuration, or persistence.

All Pi‑hole deployments running the web interface version earlier than 6.0 are affected. Owners and administrators should verify the installed package version; any installation that has not been upgraded to 6.0 or later carries the risk.

The CVSS score of 8.9 indicates a high severity vulnerability. The EPSS score is reported as less than 1 percent, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely publicized exploits yet. Nevertheless, the attack vector is a crafted HTTP POST request to the settings endpoint, which does not require any user interaction with rendered content. Successful exploitation would provide the attacker with root-level access to the system, enabling complete takeover and potential lateral movement.