PT-2026-30626 · Pi-Hole · Pi-Hole

Andrejtomci + 2 · CVE-2026-33403 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.0 through 6.4

Description A reflected DOM-based XSS (Cross-Site Scripting) issue exists in taillog.js. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the file query parameter is interpolated into an innerHTML assignment without proper escaping. Additionally, the Content-Security-Policy lacks a form-action directive, which allows injected <form> elements to exfiltrate credentials to an external origin.

Recommendations Update to version 6.5.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33403

GHSA-7XQW-R9PR-QV59

Affected Products

Pi-Hole

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33403.json · Exploit
• 🔥 https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33403 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33403 · Vendor Advisory