What’s Vulnerable › Vulnerabilities

CVE-2022-31029: Authenticated XSS in Pi-hole AdminLTE

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-07 · updated 2026-06-17
• Weakness: CWE-79

Description

AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• pi-hole AdminLTE: before 5.13 — fixed in 5.13

How to fix

Upgrade to a fixed version: pi-hole AdminLTE 5.13. Check the vendor advisory for mitigations.

References

• https://github.com/pi-hole/AdminLTE/commit/b07372bd426ca8111824a0244dc89d07a7243509
• https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cfr5-rqm5-9vhp
• https://github.com/pi-hole/AdminLTE/commit/b07372bd426ca8111824a0244dc89d07a7243509
• https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cfr5-rqm5-9vhp

Get alerted when CVE-2022-31029 or the next vulnerability affects your stack