CVE-2025-53533
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping.
Risk Assessment
An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the victim's browser when visited. This can lead to session theft, account takeover, or other malicious actions within the Pi-hole interface context.
Recommendation
It is recommended to immediately update Pi-hole to version 6.3 or later, which includes the fix. Also, educate users about the risk of clicking suspicious links.
Other vulnerabilities in Pi-hole Admin Interface
See all- CVE-2025-59151High
Pi-hole Admin Interface before version 6.3 is vulnerable to CRLF injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without proper input sanitization. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both headers and content of the HTTP response, enabling injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and weakening or bypassing browser-based security mechanisms such as CSP or X-XSS-Protection.
- CVE-2025-32785Medium
Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript that executes when another user navigates to the Tools section and performs a gravity database update. The vulnerability is patched in version 6.3.
Original NVD description (English source)
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS