CVE-2026-33403: Pi-hole Admin Interface XSS Vulnerability

CVE-2026-33403 Overview

A reflected DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in the Pi-hole Admin Interface, the web-based management console for Pi-hole network-level ad and tracker blocking application. The vulnerability exists in versions 6.0 through 6.5 (exclusive) and allows unauthenticated attackers to inject arbitrary HTML into the admin interface by crafting malicious URLs targeting the taillog.js file.

Critical Impact
Attackers can exploit this vulnerability to inject malicious HTML and JavaScript, potentially exfiltrating admin credentials to external origins due to a missing form-action directive in the Content-Security-Policy.

Affected Products

Pi-hole Admin Interface versions 6.0 to before 6.5
Pi-hole Web Interface (pi-hole/web)

Discovery Timeline

2026-04-06 - CVE CVE-2026-33403 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-33403

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the taillog.js file within the Pi-hole Admin Interface where the file query parameter is directly interpolated into an innerHTML assignment without proper escaping or sanitization.

The DOM-based nature of this XSS means the malicious payload is processed entirely on the client side, making it more difficult to detect through traditional server-side security controls. When a user clicks on a specially crafted URL, the attacker-controlled content is injected directly into the Document Object Model.

Compounding this issue is the absence of a form-action directive in the application's Content-Security-Policy (CSP). This missing directive creates a secondary attack vector where injected <form> elements can submit data to external origins controlled by the attacker. This effectively allows credential theft when administrators interact with the injected content.

Root Cause

The root cause is improper input validation and output encoding in the taillog.js JavaScript file. The file query parameter from the URL is used directly in an innerHTML assignment without sanitizing the input for HTML special characters. This violates secure coding principles that require user-controlled input to be properly escaped before being rendered in the DOM.

Additionally, the Content-Security-Policy header lacks the form-action directive, which should restrict where forms can submit data. Without this protection, even if script execution is partially mitigated, attackers can still leverage HTML injection through form elements to exfiltrate sensitive data.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious URL containing the XSS payload in the file parameter and trick an authenticated Pi-hole administrator into clicking the link. This could be accomplished through phishing emails, social engineering, or embedding the link on a compromised website.

Once the victim clicks the malicious URL, the payload executes in the context of their authenticated session with the Pi-hole admin interface. The attacker can then inject forms that mimic legitimate login prompts, capture keystrokes, steal session tokens, or redirect the administrator to attacker-controlled infrastructure.

The vulnerability manifests in the taillog.js file where the file query parameter is interpolated into an innerHTML assignment without proper escaping. For technical details and proof-of-concept information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33403

Indicators of Compromise

Unusual URL patterns in web server logs containing encoded HTML or JavaScript in the file parameter
Access logs showing requests to taillog.js with suspicious query string values containing angle brackets or script tags
Network traffic to unexpected external domains originating from the Pi-hole admin interface
Reports from users of unexpected prompts or visual changes when accessing the admin interface

Detection Strategies

Implement web application firewall (WAF) rules to detect XSS patterns in URL query parameters
Monitor for encoded HTML entities (<, >, %3C, %3E) in requests to the Pi-hole admin interface
Deploy browser-based security monitoring to detect DOM manipulation attacks
Review Content-Security-Policy violation reports if configured in report-only mode

Monitoring Recommendations

Enable detailed access logging for the Pi-hole web interface and monitor for anomalous URL patterns
Configure alerting for any requests containing potential XSS payloads in query strings
Implement network monitoring to detect data exfiltration attempts from the Pi-hole admin interface
Regularly audit administrator access patterns for unusual activity following link clicks

How to Mitigate CVE-2026-33403

Immediate Actions Required

Upgrade Pi-hole Admin Interface to version 6.5 or later immediately
Restrict network access to the Pi-hole admin interface to trusted networks only
Implement additional network segmentation to limit exposure of the admin interface
Educate administrators about phishing risks and suspicious links targeting Pi-hole management URLs

Patch Information

The vulnerability has been fixed in Pi-hole Admin Interface version 6.5. Users should update their Pi-hole installation to this version or later to remediate the vulnerability. Detailed patch information and release notes are available in the GitHub Security Advisory.

Workarounds

Restrict access to the Pi-hole admin interface to localhost or trusted internal networks using firewall rules
Use a VPN to access the admin interface instead of exposing it directly
Implement a reverse proxy with additional CSP headers including the form-action directive
Consider disabling web interface access temporarily and managing Pi-hole via command line until patched

bash

# Example: Restrict Pi-hole admin access to localhost only using iptables
iptables -A INPUT -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Alternative: Configure lighttpd to bind only to localhost
# Edit /etc/lighttpd/lighttpd.conf
# server.bind = "127.0.0.1"