PT-2026-30626 · Pi-Hole · Web

Andrejtomci + 2 · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-33403

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected

elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33403

Affected Products

Web

References · 2

• 🔥 https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33403 · Security Note