PT-2025-44019 · Pi-Hole · Pi-Hole Admin Interface

Dannypete + 2 · Published 2025-10-25 · Updated 2026-04-02 · CVE-2025-53533

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.2.1 and earlier

Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole network-level advertisement and internet tracker blocking application, is susceptible to reflected cross-site scripting (XSS). This occurs due to a malformed URL path that is improperly handled on the 404 error page. Specifically, the requested path is included in the class attribute of the body tag without adequate sanitization or escaping. An attacker can exploit this by crafting a URL containing an onload attribute, which will execute arbitrary JavaScript code in the victim's browser when the malicious link is visited. Successful exploitation requires an attacker to send a crafted link to a victim, leading to the execution of attacker-controlled JavaScript code within the victim's browser session.

Recommendations Update to version 6.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00761

CVE-2025-53533

GHSA-W8F8-92RX-4F6W

Affected Products

Pi-Hole Admin Interface

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53533.json · Exploit
• https://github.com/pi-hole/web/security/advisories/GHSA-w8f8-92rx-4f6w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53533 · Security Note
• https://bdu.fstec.ru/vul/2026-00761 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53533 · Vendor Advisory
• https://t.me/CVEtracker/35877 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2039840337397760163 · Twitter Post
• https://twitter.com/gnoppixlinux/status/1983151599808634920 · Twitter Post