The dev trusted a regexp to 'validate' user input for a _privileged_ command execution, a function which fails at validating a constant-sized, colon-separated sequence of hex numbers in a string, everything about the input screams structure, and yet it was still half-assed!

Although this requires you to authenticate at the web portal, so 'some' sort of trust is necessary to gain this level of access. I believe they even have some plan of letting authenticated users update the pi-hole code from the web interface by the wording on this issue: https://discourse.pi-hole.net/t/how-do-i-update-pi-hole/249.

A funny thought: you can create a script (that uses the default password) to inject a code to schedule an update to the pi-hole (and revert the changed permissions) which fixes the vulnerability and leaves no trace! These possibilities reminds me of a hacker series!