PT-2026-30627 · Pi-Hole · Pi-Hole

Andrejtomci · CVE-2026-33404 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.0 through 6.4

Description Client hostnames and IP addresses from the FTL database are rendered into the Document Object Model (DOM) without proper escaping in the Network page (network.js) and Dashboard chart tooltips (charts.js/index.js). Although upstream validation in dnsmasq and FTL blocks HTML characters through standard DHCP and DNS paths, the web interface fails to perform output escaping, creating an inconsistency with other properly escaped fields in the same files.

Recommendations Update to version 6.5.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33404

GHSA-PX6W-85WP-WW9V

Affected Products

Pi-Hole

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33404.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33404 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33404 · Vendor Advisory
• https://github.com/pi-hole/web/security/advisories/GHSA-px6w-85wp-ww9v · Note