CVE-2025-32785 Overview
CVE-2025-32785 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Pi-hole Admin Interface. The flaw affects all versions prior to 6.3 and resides in the Subscribed Lists group management section. An authenticated user can inject JavaScript through the Address field when creating or editing a list entry. The payload executes when another user navigates to the Tools section and triggers a gravity database update. The vulnerability was patched in Pi-hole Web Interface version 6.3. See the GitHub Security Advisory GHSA-7w6h-3gwc-qhq5 for upstream details.
Critical Impact
An authenticated attacker can execute arbitrary JavaScript in the browser session of another Pi-hole administrator, enabling session abuse and unauthorized configuration changes.
Affected Products
- Pi-hole Web Interface versions prior to 6.3
- Pi-hole deployments exposing the Admin Interface to multiple authenticated users
- Self-hosted Pi-hole instances using the Subscribed Lists feature
Discovery Timeline
- 2025-10-27 - CVE-2025-32785 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-32785
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Pi-hole Admin Interface. The Address field in the Subscribed Lists group management section accepts user input without proper sanitization. Special characters and <script> tags bypass input validation and are persisted in the gravity database configuration. When another administrator opens the Tools section and performs a gravity database update, the stored payload renders in the response page. The injected JavaScript then executes under the origin of the Pi-hole Admin Interface. Because requests execute inside an authenticated session, the attacker inherits the privileges of the victim user. This enables modification of DNS blocklists, group assignments, or other administrative settings available through the web UI.
Root Cause
The root cause is missing output encoding and insufficient input validation on the Address field used for subscribed adlist entries. The backend persists attacker-controlled strings verbatim, and the frontend renders them without contextual escaping during the gravity update workflow.
Attack Vector
Exploitation requires an authenticated account with permission to add or edit entries in the Subscribed Lists interface. The attacker submits a crafted Address value containing an HTML or JavaScript payload. The payload remains dormant until a second user with access to the Admin Interface triggers a gravity database update from the Tools section. User interaction from the victim is therefore required to execute the payload.
No verified public proof-of-concept code is available. Refer to the Pi-hole security advisory for additional technical context.
Detection Methods for CVE-2025-32785
Indicators of Compromise
- Entries in the Pi-hole adlist or gravity database containing HTML tags, <script> fragments, event handlers such as onerror=, or javascript: URIs in the Address field.
- Unexpected modifications to adlist groups, blocklists, or whitelist entries following a gravity update by an administrator.
- Admin Interface audit entries showing adlist creation or edits from accounts that do not normally manage subscribed lists.
Detection Strategies
- Inspect the gravity database and adlist configuration for Address field values that are not valid URLs.
- Review web server access logs for POST requests to the group management endpoints containing script-like payloads.
- Monitor browser console errors or Content Security Policy (CSP) violation reports originating from the Admin Interface Tools section.
Monitoring Recommendations
- Enable and centrally collect Pi-hole Admin Interface access logs for review of adlist create and update operations.
- Alert on administrative actions performed by low-privilege or newly created accounts that touch Subscribed Lists.
- Periodically audit the stored adlist entries for syntactically invalid URLs that may indicate injected payloads.
How to Mitigate CVE-2025-32785
Immediate Actions Required
- Upgrade the Pi-hole Web Interface to version 6.3 or later on all managed instances.
- Audit all existing Subscribed List entries and remove any Address values containing HTML, JavaScript, or non-URL characters.
- Rotate credentials for Admin Interface accounts if suspicious adlist entries are discovered.
Patch Information
The vulnerability is fixed in Pi-hole Web Interface version 6.3. Upgrade instructions and release details are available in the GitHub Security Advisory GHSA-7w6h-3gwc-qhq5. Users running package-managed installations should run the Pi-hole updater (pihole -up) to apply the patched release.
Workarounds
- Restrict access to the Pi-hole Admin Interface to a minimal set of trusted administrators until the patch is applied.
- Place the Admin Interface behind an authenticated reverse proxy or VPN to reduce the pool of users able to submit adlist entries.
- Avoid performing gravity database updates from the Tools section until all stored adlist Address values have been validated.
# Upgrade Pi-hole to a patched release
pihole -up
# Verify the Web Interface version is 6.3 or later
pihole -v
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
