CVE-2026-33406 Details
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5.
A stored HTML attribute injection vulnerability has been identified in the Pi-hole Admin Interface versions 6.0 prior to 6.5. The issue arises because configuration values from the /api/config endpoint are inserted directly into HTML value attributes without proper escaping, particularly in settings-advanced.js. This flaw allows a double quote in any config value to break out of the attribute context, enabling the injection of arbitrary HTML attributes. While the server's Content Security Policy (CSP) blocks JavaScript execution, the injected attributes can be used to manipulate element styling, potentially leading to UI redressing. The vulnerability can be exploited by importing a malicious teleporter backup, which bypasses server-side validation for individual fields.
Users can update to Pi-hole Admin Interface version 6.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pi-hole/web/security/advisories/GHSA-9rfm-c5g6-538p | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pi-hole web interface | >= 6.0, <= 6.4.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |