FTLDNS, the engine that powers Pi‑hole’s DNS and statistics, contains a flaw that allows an authenticated user to inject arbitrary configuration lines into the DHCP hosts file through newline characters. The injected directives are processed by dnsmasq, granting the attacker the ability to execute system commands. This creates a classic command‑execution vector, compromising confidentiality, integrity, and availability of the entire host running Pi‑hole.

Products affected are the Pi‑hole FTL (FTLDNS) component, specifically versions from 6.0 up to, but not including, 6.6. All installations relying on those firmware releases are susceptible until a higher version is installed.

The flaw is rated with a CVSS score of 8.8, indicating a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based access through Pi‑hole’s privileged API. An attacker must first authenticate, but once authenticated they can issue the malicious payload that will be interpreted by the underlying system shell.