A newline injection vulnerability in the dns.interface field of Pi‑hole FTL allows an attacker to insert arbitrary directives into the generated dnsmasq configuration file. The attacker can add commands such as dhcp-script=/tmp/p fit, which is then executed when the host processes DHCP leases. Since Pi‑hole’s configuration API is exposed without credentials on installations lacking an admin password, a network‑adjacent attacker can exploit this flaw without authentication and achieve arbitrary command execution on the underlying host, giving full control over both the device and the network it serves.

Pi‑hole FTL versions prior to 6.6.1 on deployments with the default unsecured configuration (no admin password).

The CVSS score of 8.7 signals a high severity impact with moderate complexity. The EPSS score is not available, but the vulnerability’s presence in the default configuration exposes it widely. It is not listed in CISA’s KEV catalog, yet the lack of authentication and the ability to persist changes across reboots increases the likelihood of exploitation. An attacker operating on the local network can trigger the breach by submitting a crafted request to the unsecured API, after which the malicious payload will execute during any DHCP lease transaction.