pi-hole/FTL v6.7.1 on GitHub

Security Fixes

pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via webserver.advancedOpts (High) reported by keithlinneman
pi-hole/FTL/security/advisories/GHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in misc.dnsmasq_lines (High) reported by keithlinneman
pi-hole/FTL/security/advisories/GHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)
pi-hole/FTL/security/advisories/GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110

misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.
Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.
The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.
database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.

pi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#3050)
An infinite loop in the dnsmasq config test when debug.config is enabled
Webserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)
Async-signal-safety in the real-time signal handler and the TCP worker terminator
Query indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committed
Database connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctness
Memory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan

Full Changelog: v6.7...v6.7.1