CVE-2025-53533 Overview
CVE-2025-53533 is a reflected cross-site scripting (XSS) vulnerability affecting the Pi-hole Admin Interface. Pi-hole is a network-level advertisement and internet tracker blocking application, and its web interface is used to configure and monitor the service. Versions 6.2.1 and earlier fail to sanitize the requested URL path when rendering the 404 error page. The path is reflected into the class attribute of the HTML body tag, allowing an attacker to inject an onload handler that executes arbitrary JavaScript in the victim's browser. The issue is patched in version 6.3.
Critical Impact
An attacker who convinces an authenticated Pi-hole administrator to click a crafted link can execute JavaScript in the context of the admin interface, enabling session abuse and unauthorized configuration changes.
Affected Products
- Pi-hole Web Interface versions 6.2.1 and earlier
- Pi-hole Admin Interface deployments exposing the 404 error page
- Fixed in Pi-hole Web Interface 6.3
Discovery Timeline
- 2025-10-27 - CVE-2025-53533 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53533
Vulnerability Analysis
The flaw is a reflected cross-site scripting issue [CWE-79] in the Pi-hole Admin Interface. When a client requests a non-existent path, the application generates a 404 error page that embeds the requested URL path directly into the class attribute of the <body> element. The path is inserted without HTML attribute escaping or input sanitization. An attacker can therefore break out of the class attribute and introduce additional attributes, such as an onload event handler, which the browser will execute when it parses the response.
Exploitation requires user interaction: the victim must visit a crafted link pointing to their own Pi-hole instance. Because the payload executes in the security context of the Pi-hole Admin Interface origin, the attacker's JavaScript can read page content, invoke authenticated administrative endpoints, and modify DNS-blocking configuration if the victim has an active admin session.
Root Cause
The root cause is missing output encoding on the requested path when it is reflected into an HTML attribute on the 404 error page. The template concatenates the untrusted path into the body tag's class attribute without escaping quotes, angle brackets, or whitespace. Any character that terminates an attribute value becomes usable for injecting additional attributes and event handlers.
Attack Vector
An attacker crafts a URL to the target Pi-hole admin host that appends a malformed path segment containing an attribute-breaking payload, for example a quote character followed by an onload handler. The attacker delivers the URL through phishing, chat, or a link on an attacker-controlled page. When the victim's browser requests the URL, the Pi-hole server returns the 404 page with the payload reflected inside the bodyclass attribute. The browser then executes the injected JavaScript.
No authentication is required for the server to reflect the payload, but the impact is highest when the victim is an authenticated administrator. See the Pi-hole GitHub Security Advisory for further technical detail. No public proof-of-concept exploit code is referenced in the advisory.
Detection Methods for CVE-2025-53533
Indicators of Compromise
- HTTP request logs on the Pi-hole admin host showing 404 responses for paths containing onload, onerror, quote characters, or <script> fragments.
- Referrer headers to the Pi-hole admin interface originating from unexpected external domains or shortener services.
- Unexpected administrative changes such as new whitelist or blocklist entries, DNS record modifications, or new admin sessions following a user's click on an external link.
Detection Strategies
- Inspect web server access logs for URI paths containing HTML metacharacters (", ', <, >, =) or event-handler keywords like onload= and onerror=.
- Deploy a web application firewall rule that blocks requests to the Pi-hole admin interface where the path contains attribute-breaking characters.
- Alert on 404 responses from the admin interface that include unusually long paths or non-standard characters.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) report-only endpoint to capture inline-script violations on the admin interface.
- Monitor administrative API endpoints for configuration changes correlated in time with 404 events containing suspicious path characters.
- Track browser console errors and CSP reports from admin users as a signal for attempted XSS execution.
How to Mitigate CVE-2025-53533
Immediate Actions Required
- Upgrade the Pi-hole Web Interface to version 6.3 or later on all managed Pi-hole instances.
- Restrict access to the Pi-hole admin interface to trusted management networks or VPN clients rather than exposing it to the public internet.
- Terminate active admin sessions and rotate the admin password after patching if the interface was internet-reachable.
Patch Information
The vendor fixed CVE-2025-53533 in Pi-hole Web Interface version 6.3 by sanitizing the reflected path before it is written to the 404 error page. Details are published in the Pi-hole GitHub Security Advisory GHSA-w8f8-92rx-4f6w. Administrators using distribution packages should verify that the packaged web component is at version 6.3 or higher.
Workarounds
- Place the Pi-hole admin interface behind a reverse proxy that strips or rejects request paths containing HTML metacharacters until the patch is applied.
- Apply a strict Content Security Policy that disallows inline event handlers on the admin interface to blunt XSS execution.
- Instruct administrators to avoid clicking third-party links that point to their Pi-hole admin host, and to log out of the admin console when not in active use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
