PT-2026-20961 · Pi-Hole · Pi-Hole
T0X1Cx
·
Published
2026-02-19
·
Updated
2026-03-12
·
CVE-2026-26953
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Pi-hole versions 6.0 through 6.4.0
Description
Pi-hole Admin Interface, a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application, contains a Stored HTML Injection issue in the active sessions table on the API settings page. An attacker with valid credentials can inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The
rowCallback function uses the data.x forwarded for value, which is directly concatenated into an HTML string and inserted into the Document Object Model (DOM) using jQuery’s .html() method. This allows malicious HTML tags within the X-Forwarded-For header to be parsed and rendered by the browser. Attackers can use tools like curl, wget, Python requests, Burp Suite, or JavaScript fetch() to send authentication requests with a crafted X-Forwarded-For header. The Content Security Policy (CSP) implemented by Pi-hole blocks inline JavaScript, limiting the impact to HTML injection only.Recommendations
Update Pi-hole to version 6.4.1 or later.
Exploit
Fix
XSS
RCE
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pi-Hole