CVE-2026-33404 Details
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.
A stored cross-site scripting vulnerability has been identified in the Pi-hole Admin Interface versions 6.0 prior to 6.5. The issue arises because client hostnames and IP addresses from the FTL database are rendered into the DOM without proper escaping. This flaw is present in the Network page's 'network.js' and in the Dashboard chart tooltips within 'charts.js' and 'index.js'. While upstream validation in dnsmasq and FTL typically blocks HTML characters through standard DHCP and DNS paths, the web interface fails to escape output in these specific JavaScript files, creating an inconsistency with other fields that are properly sanitized. Exploitation of this vulnerability requires direct access to the filesystem to manipulate the FTL database or the DHCP lease file, as the web UI's lack of escaping allows injected HTML to be executed.
Users can update to Pi-hole Admin Interface version 6.5, which addresses this vulnerability by implementing the necessary output escaping.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pi-hole/web/security/advisories/GHSA-px6w-85wp-ww9v | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pi-hole web interface | >= 6.0, <= 6.4.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |