Two shell scripts executed as root by systemd read an unvalidated configuration file path and use it in privileged file operations. An attacker with pihole privilege can write a malicious file path to the configuration and cause root to delete and then recreate any file outside the protected directories, thereby gaining write access to arbitrary files, including the SSH authorized_keys file. The flaw originates from improper handling of configuration data (CWE‑15), improper permission handling (CWE‑269), and incorrect file permissions (CWE‑732).

The vulnerability affects Pi‑hole installations running Core versions 6.0 up to, but not including, Core 6.4.2, as well as FTL versions up to, but not including, FTL 6.6.1. The flaw is present in the systemd unit that invokes the pre‑start and post‑stop shell scripts pihole‑FTL‑prestart.sh and pihole‑FTL‑poststop.sh, both executed with root privileges. An attacker must have the right to modify the Pi‑hole configuration directory to abuse the flaw.

The CVSS score of 8.8 indicates high severity, and while the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog. The attack surface is local: a user who can modify Pi‑hole configuration files must already run commands with pihole privilege. By writing an arbitrary path into files.pid, the attacker can cause the system to delete and recreate files, such as /root/.ssh/authorized_keys, giving the attacker root shell access. Because the flaw occurs at service start and stop, the attacker can execute the exploit with any normal Pi‑hole restart.