ETK-2026-4228Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4228",
  "cve_id": null,
  "display_id": "ETK-2026-4228",
  "ghsa_id": "GHSA-pj9m-9623-2g75",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Command injection in Pi-hole FTL and Core gravity handling",
  "summary": "Pi-hole FTL and Pi-hole Core versions before the listed fixes mishandle the configured gravity database path during gravity processing. An authenticated administrator able to modify configuration through the API and trigger gravity processing can cause commands to execute as the pihole user.",
  "mitigation": "Update Pi-hole FTL to 6.9 and Pi-hole Core to 6.6 together. Restrict administrative API access to trusted administrators until both updates are deployed.",
  "vendor": "other",
  "product": "other:pi-hole/FTL",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "= 6.8"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "6.9"
      ],
      "package_name": "pi-hole/FTL",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 6.5"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "6.6"
      ],
      "package_name": "pi-hole",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.532377466666667,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-11T19:21:46+00:00",
      "days": -0.2301966130324074,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T00:53:15.029178+00:00",
      "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-pj9m-9623-2g75"
    },
    "trigger_signal": {
      "at": "2026-11-11T19:21:46+00:00",
      "days": -0.2301966130324074,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T00:53:15.029178+00:00",
      "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-pj9m-9623-2g75"
    }
  }
}