ETK-2026-4210Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4210",
  "cve_id": null,
  "display_id": "ETK-2026-4210",
  "ghsa_id": "GHSA-cq9w-mv93-mxh7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "SQL injection in Pi-hole Core gravity database handling",
  "summary": "Pi-hole Core versions before 6.6 can incorporate an unescaped gravity database path into an SQL operation. An attacker able to set that path through the API could cause SQL statements, and potentially commands, to run as the pihole user.",
  "mitigation": "Upgrade Pi-hole Core to version 6.6 or later. Until upgraded, restrict access to the API and prevent untrusted users from changing gravity database path settings.",
  "vendor": "other",
  "product": "other:pi-hole",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 6.5"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "6.6"
      ],
      "package_name": "pi-hole",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.538907233333333,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T19:22:05+00:00",
      "days": -0.06614741019675927,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T20:57:20.246237+00:00",
      "url": "https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cq9w-mv93-mxh7"
    }
  }
}