Pi-hole patches command-execution flaws and debug-log data leak in FTL v6.9 and Core v6.6

The maintainers of Pi-hole, the popular open-source network-wide ad blocker, have released FTL v6.9 and Core v6.6, fixing a series of security advisories spanning high, medium and low severity. The most serious issues carry CVSS scores of 7.2 to 7.3 and all require admin-level access, but are nonetheless significant: one chain allowed command execution through the files.gravity file, as both gravity.sh and Teleporter inserted it into SQL unescaped, while the installer previously followed symlinks in /etc/pihole and ran root-owned operations on pihole-controlled paths, including in pihole -d.

Separately flagged as a medium-severity issue with practical consequences, the pihole -d debug log, which can be uploaded to Pi-hole's tricorder service, included password hashes and TOTP secrets; users who have uploaded a debug log are advised to reset their passwords and re-enrol 2FA. The update also fixes two crashes reachable with a valid session, an ACL bypass on dual-stack ports, and queries recorded at maximum privacy level leaking into the database once the level was lowered.

Version 6.9 of FTL backports fixes from the development branch and refreshes bundled dependencies, updating embedded dnsmasq to v2.93+42, SQLite to v3.54.1 and the TRE regex engine to current upstream master. The TRE update changes how some stored regex filters match, {,n} now means {0,n}, and some constructs like deeply nested approximate-matching groups are rejected, which is why the team shipped it as a minor release rather than a 6.8.1 patch.

Performance gets attention too: regex matching is faster, and gravity.db is only reopened when it changes on disk, a change said to account for most of FTL's idle CPU time. Core v6.6, meanwhile, continues the project's privilege-hardening push: Pi-hole now drops from root to the pihole user via setpriv rather than sudo, the installer writes into /etc/pihole only as the pihole user, and the debug tool runs unprivileged while excluding password hashes and TOTP secrets from its output.

Users can update with pihole -up, with the team recommending a Teleporter backup beforehand as a safety net, and Docker deployments are served by a new image tagged 2026.11.0. The web interface itself sees no release this cycle and stays at v6.6.1.