CVE-2025-53533
Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
INFO
Published Date :
Oct. 27, 2025, 7:16 p.m.
Last Modified :
Oct. 8, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Pi-hole Admin Interface to version 6.3.
- Sanitize or escape user input for URL paths.
- Validate all user-supplied input.
- Implement output encoding for all web content.
Public PoC/Exploit Available at Github
CVE-2025-53533 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-53533.
| URL | Resource |
|---|---|
| https://github.com/pi-hole/web/security/advisories/GHSA-w8f8-92rx-4f6w | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-53533 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-53533
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Cross-Site-Scripting XSS in Pi-hole-CVE-2025-53533 exploit (PoC)
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-53533 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-53533 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Translation Title: web de pi-hole, Description: Pi-hole Admin Interface es una interfaz web para gestionar Pi-hole, una aplicación de bloqueo de anuncios y rastreadores de internet a nivel de red. Las versiones 6.2.1 y anteriores de Pi-hole Admin Interface son vulnerables a cross-site scripting (XSS) reflejado a través de una ruta URL malformada. La página de error 404 incluye la ruta solicitada en el atributo class de la etiqueta body sin una sanitización o escape adecuados. Un atacante puede crear una URL que contenga un atributo onload que ejecutará código JavaScript arbitrario en el navegador cuando una víctima visite el enlace malicioso. Si un atacante envía un enlace de Pi-hole manipulado a una víctima y esta lo visita, el código JavaScript controlado por el atacante se ejecuta en el navegador de la víctima. Esto ha sido parcheado en la versión 6.3. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'pi-hole', 'product': 'web', 'versions': [{'status': 'affected', 'version': '< 6.3'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-53533', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-27T19:18:54.834978Z'} -
Initial Analysis by [email protected]
Dec. 18, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:* versions up to (excluding) 6.3 Added Reference Type GitHub, Inc.: https://github.com/pi-hole/web/security/advisories/GHSA-w8f8-92rx-4f6w Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Oct. 27, 2025
Action Type Old Value New Value Added Description Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/pi-hole/web/security/advisories/GHSA-w8f8-92rx-4f6w