CVE-2025-32785
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript that executes when another user navigates to the Tools section and performs a gravity database update. The vulnerability is patched in version 6.3.
Risk Assessment
An attacker can hijack an administrator's session or perform actions on their behalf, potentially leading to full compromise of the Pi-hole admin interface.
Recommendation
Upgrade Pi-hole Admin Interface to version 6.3 or later. Restrict access to the admin interface to trusted networks.
Other vulnerabilities in Pi-hole Admin Interface
See all- CVE-2025-59151High
Pi-hole Admin Interface before version 6.3 is vulnerable to CRLF injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without proper input sanitization. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both headers and content of the HTTP response, enabling injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and weakening or bypassing browser-based security mechanisms such as CSP or X-XSS-Protection.
- CVE-2025-53533Medium
Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping.
Original NVD description (English source)
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS