A critical remote code execution vulnerability in Pi-hole FTL allows authenticated attackers to gain full control over the underlying host system.

This flaw involves improper neutralization of CRLF sequences and OS command injection within the dns.upstreams configuration parameter. An attacker with authenticated access can inject arbitrary dnsmasq directives to trigger command execution on the host server.

The ability to execute arbitrary commands on the underlying host poses a severe risk to the entire network infrastructure, as Pi-hole often acts as a critical DNS resolver. Successful exploitation could lead to full system compromise, data theft, or the use of the server as a pivot point for lateral movement within the environment. With a CVSS score of 8.8, this high-severity vulnerability warrants immediate attention to prevent unauthorized administrative control.

Immediate Action: Update the pihole-FTL component to version 6.6 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Review system logs and the Pi-hole web interface configuration history for anomalous entries in the upstream DNS server settings.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to known, trusted IP addresses using a firewall or reverse proxy to limit the exposure of the management interface.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub repository.

Given the potential for remote code execution and the availability of public proof-of-concept material, this vulnerability presents a significant risk to internal network integrity. IT administrators must prioritize patching the pihole-FTL engine to version 6.6 immediately. Restricting access to the management interface is a vital secondary measure to reduce the attack surface until the update can be fully deployed.