PT-2025-44026 · Pi-Hole · Pi-Hole Admin Interface

T0X1Cx · Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-59151

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions prior to 6.3

Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole advertisement and internet tracker blocking application, contains a Carriage Return Line Feed (CRLF) injection flaw. When handling requests for files ending with the .lp extension, the application fails to properly sanitize input, allowing attackers to inject carriage return and line feed characters (%0d%0a). This enables manipulation of HTTP response headers and content, potentially leading to session fixation, cache poisoning, and weakening of browser security mechanisms like Content Security Policy or X-XSS-Protection. The vulnerability occurs when a request is made to a file ending with the .lp extension, and the application performs a redirect without proper input sanitization.

Recommendations Update to version 6.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

CWE-93

Related Identifiers

CVE-2025-59151

GHSA-5V79-P56F-X7C4

Affected Products

Pi-Hole Admin Interface

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59151.json · Exploit
• https://github.com/pi-hole/web/security/advisories/GHSA-5v79-p56f-x7c4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59151 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59151 · Vendor Advisory
• https://twitter.com/CveTodo/status/1983050899665699211 · Twitter Post
• https://t.me/CVEtracker/35889 · Telegram Post