CVE-2026-33403: Pi-hole Admin Interface XSS Vulnerability

CVE-2026-33403 Overview

A reflected DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in the Pi-hole Admin Interface, the web-based management console for Pi-hole network-level ad and tracker blocking application. The vulnerability exists in versions 6.0 through 6.5 (exclusive) and allows unauthenticated attackers to inject arbitrary HTML into the admin interface by crafting malicious URLs targeting the taillog.js file.

Critical Impact

Attackers can exploit this vulnerability to inject malicious HTML and JavaScript, potentially exfiltrating admin credentials to external origins due to a missing form-action directive in the Content-Security-Policy.

Affected Products

• Pi-hole Admin Interface versions 6.0 to before 6.5
• Pi-hole Web Interface (pi-hole/web)

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-33403 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-33403

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the taillog.js file within the Pi-hole Admin Interface where the file query parameter is directly interpolated into an innerHTML assignment without proper escaping or sanitization.

The DOM-based nature of this XSS means the malicious payload is processed entirely on the client side, making it more difficult to detect through traditional server-side security controls. When a user clicks on a specially crafted URL, the attacker-controlled content is injected directly into the Document Object Model.

Compounding this issue is the absence of a form-action directive in the application's Content-Security-Policy (CSP). This missing directive creates a secondary attack vector where injected <form> elements can submit data to external origins controlled by the attacker. This effectively allows credential theft when administrators interact with the injected content.

Root Cause

The root cause is improper input validation and output encoding in the taillog.js JavaScript file. The file query parameter from the URL is used directly in an innerHTML assignment without sanitizing the input for HTML special characters. This violates secure coding principles that require user-controlled input to be properly escaped before being rendered in the DOM.

Additionally, the Content-Security-Policy header lacks the form-action directive, which should restrict where forms can submit data. Without this protection, even if script execution is partially mitigated, attackers can still leverage HTML injection through form elements to exfiltrate sensitive data.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious URL containing the XSS payload in the file parameter and trick an authenticated Pi-hole administrator into clicking the link. This could be accomplished through phishing emails, social engineering, or embedding the link on a compromised website.

Once the victim clicks the malicious URL, the payload executes in the context of their authenticated session with the Pi-hole admin interface. The attacker can then inject forms that mimic legitimate login prompts, capture keystrokes, steal session tokens, or redirect the administrator to attacker-controlled infrastructure.

The vulnerability manifests in the taillog.js file where the file query parameter is interpolated into an innerHTML assignment without proper escaping. For technical details and proof-of-concept information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33403

Indicators of Compromise

• Unusual URL patterns in web server logs containing encoded HTML or JavaScript in the file parameter
• Access logs showing requests to taillog.js with suspicious query string values containing angle brackets or script tags
• Network traffic to unexpected external domains originating from the Pi-hole admin interface
• Reports from users of unexpected prompts or visual changes when accessing the admin interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS patterns in URL query parameters
• Monitor for encoded HTML entities (<, >, %3C, %3E) in requests to the Pi-hole admin interface
• Deploy browser-based security monitoring to detect DOM manipulation attacks
• Review Content-Security-Policy violation reports if configured in report-only mode

Monitoring Recommendations

• Enable detailed access logging for the Pi-hole web interface and monitor for anomalous URL patterns
• Configure alerting for any requests containing potential XSS payloads in query strings
• Implement network monitoring to detect data exfiltration attempts from the Pi-hole admin interface
• Regularly audit administrator access patterns for unusual activity following link clicks

How to Mitigate CVE-2026-33403

Immediate Actions Required

• Upgrade Pi-hole Admin Interface to version 6.5 or later immediately
• Restrict network access to the Pi-hole admin interface to trusted networks only
• Implement additional network segmentation to limit exposure of the admin interface
• Educate administrators about phishing risks and suspicious links targeting Pi-hole management URLs

Patch Information

The vulnerability has been fixed in Pi-hole Admin Interface version 6.5. Users should update their Pi-hole installation to this version or later to remediate the vulnerability. Detailed patch information and release notes are available in the GitHub Security Advisory.

Workarounds

• Restrict access to the Pi-hole admin interface to localhost or trusted internal networks using firewall rules
• Use a VPN to access the admin interface instead of exposing it directly
• Implement a reverse proxy with additional CSP headers including the form-action directive
• Consider disabling web interface access temporarily and managing Pi-hole via command line until patched

# Example: Restrict Pi-hole admin access to localhost only using iptables
iptables -A INPUT -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Alternative: Configure lighttpd to bind only to localhost
# Edit /etc/lighttpd/lighttpd.conf
# server.bind = "127.0.0.1"