CVE-2026-33406: Pi-hole Admin Interface XSS Vulnerability

CVE-2026-33406 Overview

CVE-2026-33406 is a Cross-Site Scripting (XSS) vulnerability affecting the Pi-hole Admin Interface, a web interface for managing Pi-hole network-level ad and tracker blocking applications. The vulnerability exists in versions 6.0 through 6.4, where configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without proper escaping in settings-advanced.js, enabling HTML attribute injection.

Critical Impact

Attackers can inject malicious HTML attributes by importing a crafted teleporter backup file, bypassing per-field server-side validation and enabling UI redressing attacks on Pi-hole administrators.

Affected Products

• Pi-hole Admin Interface versions 6.0 to 6.4
• Pi-hole Web Interface (pi-hole/web repository)

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-33406 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-33406

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw originates from insufficient output encoding in the settings-advanced.js file where configuration values retrieved from the /api/config endpoint are directly inserted into HTML attribute contexts without proper escaping.

When a double quote character appears in any configuration value, it breaks out of the intended value="" attribute context, allowing attackers to inject arbitrary HTML attributes into page elements. While the server's Content Security Policy (CSP) with script-src 'self' directive effectively blocks JavaScript execution, the injected attributes can still modify element styling and behavior, enabling UI redressing attacks.

Root Cause

The root cause is improper output encoding of user-controlled configuration data before insertion into HTML attributes. The settings-advanced.js file fails to escape special characters (particularly double quotes) when populating form field values from the API response, creating an attribute injection vulnerability.

Attack Vector

The primary attack vector involves importing a malicious teleporter backup file. Teleporter is Pi-hole's backup/restore functionality that allows administrators to export and import configurations. An attacker can craft a backup file containing malicious configuration values with embedded HTML attribute injection payloads.

When an administrator imports this malicious backup, the injected values bypass per-field server-side validation because the teleporter import process does not apply the same validation rules as direct field edits. Once imported, the malicious configuration values are served through the /api/config endpoint and rendered unsafely in the admin interface, allowing UI manipulation through injected style attributes or other HTML modifications.

Since no verified code examples are available for this vulnerability, readers should refer to the GitHub Security Advisory for detailed technical information about the injection mechanism and payload examples.

Detection Methods for CVE-2026-33406

Indicators of Compromise

• Unexpected double quote characters or HTML attribute syntax in Pi-hole configuration values
• Modified or suspicious teleporter backup files with unusual configuration entries
• Configuration values containing style=, onclick=, onmouseover=, or other HTML attributes
• Unexplained visual changes or UI anomalies in the Pi-hole admin interface

Detection Strategies

• Review Pi-hole configuration files and database entries for suspicious patterns containing HTML special characters
• Monitor teleporter import activities and audit imported backup files before restoration
• Implement file integrity monitoring on Pi-hole configuration directories
• Analyze web server access logs for unusual patterns accessing the /api/config endpoint

Monitoring Recommendations

• Enable detailed logging for Pi-hole admin interface access and configuration changes
• Set up alerts for teleporter backup import events, especially from untrusted sources
• Monitor for configuration drift by periodically comparing current values against known-good baselines
• Implement browser developer console monitoring for unexpected DOM modifications when accessing admin pages

How to Mitigate CVE-2026-33406

Immediate Actions Required

• Upgrade Pi-hole Admin Interface to version 6.5 or later immediately
• Avoid importing teleporter backup files from untrusted or unverified sources
• Review existing configuration values for signs of injection attempts
• Restrict admin interface access to trusted networks and users only

Patch Information

The vulnerability is fixed in Pi-hole Admin Interface version 6.5. The patch implements proper HTML attribute escaping for configuration values before insertion into the DOM. Administrators should update through their standard Pi-hole update mechanism or by following the instructions in the GitHub Security Advisory.

Workarounds

• Disable or restrict access to the teleporter import functionality until patching is complete
• Implement network segmentation to limit admin interface exposure to trusted management networks only
• Use a web application firewall (WAF) to filter requests containing suspicious HTML attribute patterns
• Manually review and sanitize any teleporter backup files before importing by inspecting configuration values for HTML special characters

# Update Pi-hole to the latest version including the security fix
pihole -up

# Verify the installed web interface version
pihole -v

# Restrict admin interface to local network (example using lighttpd)
# Edit /etc/lighttpd/external.conf and add:
# $HTTP["remoteip"] !~ "192.168.1.0/24" { url.access-deny = ( "/admin/" ) }