FTLDNS, the DNS engine that powers Pi‑hole, has a flaw in how it processes the dns.upstreams configuration setting. An attacker who can authenticate to the Pi‑hole API or configuration interface can inject newline characters into this parameter. The engine then appends arbitrary dnsmasq configuration directives to its internal file, and because dnsmasq executes those directives the attacker can run shell commands on the host system, effectively taking control of the machine hosting Pi‑hole.

Versions of pi‑hole FTL from 6.0 up to, but not including, 6.6 are affected. The vulnerability was addressed in release 6.6, so any installation that is still on an earlier version remains vulnerable.

The CVSS score of 8.8 places this flaw in the high severity range. No EPSS score is available and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. The attack requires authenticated access to the Pi‑hole configuration, but once the newline injection is performed, the attacker can execute arbitrary commands without further interaction, making the omission easy to leverage against any privileged user.