Pi-hole Admin Interface CVE-2025-32785

Exploitation requires an authenticated user with access to the Pi-hole admin interface Subscribed Lists (adlist/group management) section to inject a payload into the Address field when creating or editing a list entry (PR:L). The payload is stored and does NOT execute immediately - it only triggers when a second user navigates to the Tools section and performs a gravity database update (UI:P, a passive second-order interaction). This makes it a stored XSS dependent on a specific victim workflow. Limiting factors: attacker must already hold valid admin-interface credentials, a separate privileged user must perform the gravity update for the payload to fire, and only versions prior to 6.3 are affected (patched in 6.3). Impact is limited to Low confidentiality and integrity within the browser session context, with no availability impact.

This is a genuinely low-priority issue, and multiple independent signals agree. The CVSS 4.0 base score is 2.0 (Low), driven by PR:L (authenticated attacker required), UI:P (a second user must passively perform an action), and only Low confidentiality/integrity impact (VC:L/VI:L) with no availability impact. EPSS reinforces this: 0.25% probability at the 15th percentile indicates very low expected exploitation volume. The vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation - only publicly available exploit code (POC) via the GitHub Security Advisory. Critically, exploitation is a stored/second-order XSS: the attacker (an already-authenticated Pi-hole user) plants a payload that only fires when ANOTHER user navigates to Tools and runs a gravity database update, so it is not a one-shot remote takeover. The CVSS 4.0 vector's E:P (Proof-of-Concept exploit maturity) is consistent with the reported POC and the absence of KEV. No signals conflict here: low CVSS, low EPSS, no KEV, and a self-hosted/niche product all point to minor, opportunistic risk rather than a priority.

An authenticated low-privilege Pi-hole user with access to the admin interface adds a subscribed adlist and injects a malicious <script> payload into the Address field, which is not sanitized. When an administrator later opens the Tools section and triggers a gravity database update, the stored script executes in the admin's browser session. A public POC exists in the GitHub Security Advisory, but exploitation requires both prior authentication and victim interaction, limiting real-world impact.