What is the CVSS score of CVE-2026-33403?

CVE-2026-33403 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-33403?

Yes, a patch is available for CVE-2026-33403. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-33403

EUVD-2026-19279 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 security-advisories@github.com

XSS Pi Hole Web Interface

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19279

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

AnalysisAI

Reflected DOM-based XSS in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated attackers to inject arbitrary HTML via a crafted malicious URL targeting the file parameter in taillog.js, potentially enabling credential exfiltration through injected form elements due to a missing form-action Content-Security-Policy directive; fixed in version 6.5.

Technical ContextAI

The vulnerability exists in the taillog.js file of Pi-hole's web administration interface, where user-supplied input from the file query parameter is directly interpolated into an innerHTML assignment without HTML entity encoding or input sanitization. This is a DOM-based XSS vulnerability (CWE-79) where the attack occurs on the client-side during page rendering. The root cause is compounded by an incomplete Content-Security-Policy that lacks the form-action directive, which would normally prevent form submissions to external origins. An attacker can craft a URL containing HTML/JavaScript payloads in the file parameter; when a user visits this malicious URL, the injected code executes in the context of the Pi-hole admin interface, potentially allowing interception of session tokens or credentials through injected form fields that submit to attacker-controlled servers.

RemediationAI

Upgrade Pi-hole Admin Interface to version 6.5 or later, which contains the fix for this reflected XSS vulnerability. This is the primary remediation. Users unable to upgrade immediately should implement network-level access controls to restrict access to the Pi-hole admin interface (typically port 80/443) to trusted IP addresses only, reducing the likelihood of untrusted users encountering malicious URLs targeting the interface. Additionally, review and strengthen the Content-Security-Policy configuration to explicitly include the form-action directive restricting form submissions to same-origin only. For detailed guidance and confirmation of patch deployment, consult https://github.com/pi-hole/web/security/advisories/GHSA-7xqw-r9pr-qv59.