Web Interface CVE-2026-33404

The CVSS v3.1 score of 3.4 reflects a low-severity locally-exploitable vulnerability (AV:L = local attack vector, AC:L = low complexity, PR:H = high privilege required, UI:N = no user interaction, S:U = unchanged scope, C:L = low confidentiality impact, I:L = low integrity impact, A:N = no availability impact). The high privilege requirement (PR:H) is the limiting factor-only administrators can inject hostile hostnames into the FTL database or trigger the rendering. However, the lack of UI interaction needed and the stored nature of the payload (persisted in FTL database) mean once injected, the XSS executes automatically when any admin views the Network page or Dashboard, creating lateral privilege escalation or admin-to-admin session hijacking potential. The vulnerability is NOT confirmed as actively exploited (no CISA KEV status provided), no public POC exists, and upstream validation in dnsmasq/FTL provides a practical barrier to exploitation via normal DHCP/DNS channels. Real-world risk is moderate for multi-admin Pi-hole deployments where trust between admins is not absolute, but negligible for single-admin or air-gapped home lab deployments.

An attacker with admin credentials (or who compromises an admin account) adds a malicious hostname such as '<img src=x onerror="alert(document.cookie)"></img>' to a client device via DHCP reservation or direct database manipulation. When another admin views the Network page or hovers over a Dashboard chart tooltip displaying this client, the JavaScript payload executes in their browser context with full access to the Pi-hole Admin Interface session, potentially allowing theft of admin session tokens or defacement of Pi-hole settings. The local attack vector and high privilege requirement mean this scenario is most realistic in shared-admin or compromised-admin scenarios rather than external network attacks.