Pi-hole FTL vulnerabilities

Pi-hole FTL before version 6.6.1 contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

In Pi-hole FTL before version 6.6.1, the `dns.interface` configuration field accepts newline characters without validation, allowing an attacker to inject directives into the dnsmasq config file. On installations without an admin password, a network-adjacent attacker can enable the built-in DHCP server and achieve remote code execution on the next DHCP lease request. Fixed in version 6.6.1.

In Pi-hole FTL (FTLDNS) from 6.0 to before 6.6, CLI sessions intended to be read-only could import Teleporter archives via /api/teleporter and overwrite configuration. This is an authorization bypass, fixed in 6.6.