CVE-2026-33403
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Pi-hole Admin Interface versions 6.0 to before 6.5 contain a reflected DOM-based XSS vulnerability in taillog.js. An unauthenticated attacker can inject arbitrary HTML into the admin interface via a crafted URL because the file parameter is interpolated into innerHTML without escaping. The missing form-action directive in Content-Security-Policy allows injected forms to exfiltrate credentials. The vulnerability is fixed in 6.5.
Risk Assessment
This vulnerability may allow an attacker to steal administrator credentials or perform actions on their behalf. This could lead to takeover of Pi-hole and further network attacks.
Recommendation
Update Pi-hole to version 6.5 or later. Additionally, implement a Content-Security-Policy header with form-action directive and avoid clicking unknown links leading to the admin interface.
Other vulnerabilities in Pi-hole Admin Interface
See all- CVE-2026-33405Low
In the Pi-hole Admin Interface, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The vulnerability is fixed in 6.5.
- CVE-2026-33406Medium
Pi-hole Admin Interface from 6.0 to before 6.5 places configuration values from the /api/config endpoint directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation.
- CVE-2026-33404Low
In the Pi-hole Admin Interface, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js and charts.js/index.js. Although upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping, inconsistent with other fields. The vulnerability is fixed in 6.5.
- CVE-2025-59151High
Pi-hole Admin Interface before version 6.3 is vulnerable to CRLF injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without proper input sanitization. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both headers and content of the HTTP response, enabling injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and weakening or bypassing browser-based security mechanisms such as CSP or X-XSS-Protection.
- CVE-2025-53533Medium
Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping.
- CVE-2025-32785Medium
Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript that executes when another user navigates to the Tools section and performs a gravity database update. The vulnerability is patched in version 6.3.
Original NVD description (English source)
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS