Web Interface CVE-2026-33406

CVSS 5.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N reflects network-accessible, low-complexity attack requiring user interaction (UI:R) but no privileges, yielding limited confidentiality and integrity impact. EPSS data is not provided; however, the attack requires user interaction (UI:R) and does not cross trust boundaries (S:U), limiting automated exploitability. No CISA KEV or public exploit code data is provided, suggesting this is a low-visibility vulnerability despite its unauthenticated attack vector. The real-world risk is constrained by three factors: (1) the CSP blocks script execution, reducing impact to UI manipulation rather than session hijacking or credential theft; (2) exploitation requires either direct admin access to inject config values or social engineering to import a malicious teleporter backup; and (3) typical Pi-hole deployments are on private networks or accessible only to authorized admins, narrowing the attacker pool. This is a genuine XSS flaw with CVSS-appropriate Medium severity, but not a critical remote code execution or authentication bypass.

An attacker crafts a malicious Pi-hole teleporter backup file containing a double-quote-injected configuration value (e.g., a custom DNS record or blocklist name with payload like " style="display:none" "). When an admin imports this backup into their Pi-hole instance via the web interface, the config value is stored and later rendered unescaped in settings-advanced.js. The injected style attribute hides or modifies UI elements, enabling UI redressing such as obscuring warning messages or repositioning buttons to trick the admin into unintended actions. While the CSP prevents inline script execution, the attacker achieves information disclosure or admin action manipulation without requiring direct admin authentication if social engineering is used to distribute the malicious backup.