Pi-hole Admin Interface CVE-2025-53533

Exploitation requires that the Pi-hole admin web interface (versions 6.2.1 and earlier) serve its 404 error page, which reflects the requested URL path into the body tag's class attribute without sanitization or escaping - this is default behavior, no special configuration is needed. The decisive limiting factor is required user interaction (UI:A): a victim with network reachability to the target Pi-hole instance must click an attacker-crafted malformed link. Because the admin interface is typically bound to an internal/LAN address, realistic exploitation depends on the victim being able to reach that host, narrowing exposure compared to a truly internet-facing service. No authentication is required (PR:N), and impact is limited to code execution within the victim's browser session, not the server.

This is a genuine but low-to-medium priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity, unauthenticated reflected XSS, but critically requires active victim interaction (UI:A) - the victim must click an attacker-supplied crafted link. Impact is confined to the subsequent system (SC:L/SI:L) with no direct confidentiality, integrity, or availability impact on the Pi-hole server itself (VC:N/VI:N/VA:N), which is why the base score is only 5.1 (Medium). The signals are internally consistent and point the same direction: EPSS is low at 0.59% (47th percentile), and there is no CISA KEV listing, indicating no observed widespread exploitation. Publicly available exploit code exists (referenced in the GitHub advisory), which raises the practical bar only slightly since reflected XSS is trivial to reproduce. The main caveat defenders should weigh is that the Pi-hole admin interface is normally bound to internal/LAN networks, so the AV:N 'network' vector in practice usually means the attacker needs the victim to be on a network where the Pi-hole host is reachable - a meaningful limiter not captured by the raw score.

An attacker crafts a malicious URL pointing at a victim's Pi-hole admin host with a malformed path containing an onload attribute that breaks out of the body tag's class attribute on the 404 page. The attacker delivers this link via phishing, chat, or a forum post; when the victim (who can reach their Pi-hole instance) clicks it, attacker-controlled JavaScript executes in the context of the admin interface. Publicly available exploit code exists, lowering the effort to reproduce.