What is the CVSS score of CVE-2025-59151?

CVE-2025-59151 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Pi-hole Admin Interface are affected by CVE-2025-59151?

A high-severity flaw in the Pi-hole Admin Interface (versions before 6.3) can let attackers manipulate HTTP redirect responses for .lp resources, potentially enabling session fixation, cache…

Is there a public PoC exploit available for CVE-2025-59151?

Yes, a public proof-of-concept exploit is available for CVE-2025-59151. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-59151?

Within 24 hours, inventory all Pi-hole deployments and identify any Pi-hole Admin Interface versions prior to 6.3; immediately remove public internet exposure by binding the admin interface to localhost or trusted management networks and requiring VPN or an authenticated reverse proxy for administrative access. Within 7 days, deploy WAF or reverse-proxy rules that reject or normalize requests to .lp resources containing CRLF or encoded %0d%0a sequences, enforce strict redirect allowlists, validate response headers, rotate administrator credentials and invalidate existing sessions, clear relevant caches, and review logs for suspicious .lp redirect activity. Within 30 days, continue compensating controls because no vendor-released patch identified at time of analysis, monitor Pi-hole vendor advisories for a fixed release, test any vendor-provided update in a staging environment before production deployment, and consider alternative DNS filtering controls if the admin interface cannot be adequately isolated.

Pi-hole Admin Interface CVE-2025-59151

HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2025-10-27 security-advisories@github.com

XSS Pi Hole Web Interface

8.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network request to an unsanitized .lp redirect (AV:N/AC:L/PR:N/UI:N); response splitting gives high integrity impact, minor availability effect, and no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Pi Hole added

Analysis Generated

Oct 08, 2026 - 11:46 vuln.today

CVE Published

Oct 27, 2025 - 20:15 cve.org

HIGH 8.2

DescriptionCVE.org

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.

AnalysisAI

HTTP response splitting in Pi-hole Admin Interface before 6.3 lets unauthenticated remote attackers inject CRLF sequences (%0d%0a) into redirects generated for requests to resources ending in the .lp extension, thereby manipulating HTTP response headers and body content. The injected headers can facilitate session fixation, cache poisoning, and the weakening or bypass of browser protections such as Content Security Policy and X-XSS-Protection, although the most damaging downstream effects generally require a victim to subsequently load the manipulated response. Publicly available exploit code exists, but the flaw has not been confirmed as actively exploited (CISA KEV), and EPSS is low at 0.44% (36th percentile); real-world exposure is further limited because many Pi-hole web interfaces are restricted to local networks rather than the public internet.

Technical ContextAI

The vulnerability is a classic CRLF injection (CWE-93) leading to HTTP response splitting. Pi-hole Admin Interface is the PHP-based web front end for the Pi-hole DNS sinkhole; when a request targets a file with the .lp extension, the application issues a redirect using unsanitized input, so attacker-supplied %0d%0a sequences terminate the header block prematurely and allow arbitrary headers plus a fabricated body to be appended to the response. Because the response originates from the trusted admin origin, any injected script or metadata inherits that origin's trust, which is why the flaw can undermine CSP, X-XSS-Protection, and similar browser-side defenses, and can poison shared caches or fixate sessions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L confirms a network-reachable, unauthenticated, low-complexity attack that spans no privilege boundary and primarily threatens integrity (I:H) with some availability impact (A:L) and no confidentiality impact; the associated CPE cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:* indicates all releases prior to the 6.3 fix are in scope.

RemediationAI

The primary fix is to upgrade the Pi-hole Admin Interface to version 6.3, which resolves the CRLF injection (Vendor-released patch: 6.3) and is documented in the vendor advisory at https://github.com/pi-hole/web/security/advisories/GHSA-5v79-p56f-x7c4. Until upgrading, reduce exposure by restricting the admin interface to trusted networks or a VPN so untrusted clients cannot reach the redirect endpoint, since network reachability is the main limiting factor for exploitation and closing it eliminates the attack surface at the cost of losing remote administrative access. If remote UI access is required, place the interface behind a reverse proxy that rejects or strips CR/LF (%0d%0a, %0a, %0d) characters from request paths and enforces normalized URL handling; this is a compensating control only and can be bypassed by encoding variants, so it must not substitute for the 6.3 upgrade. Also avoid caching responses from the admin origin in shared or intermediary caches and treat any suspicious session state as potentially fixated, since the flaw enables response splitting and cache poisoning once a crafted .lp request is processed.