What’s Vulnerable › Vulnerabilities
CVE-2025-53533: Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-10-27 · updated 2026-10-08
- Weakness: CWE-79
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
Affected products
- pi-hole web: before 6.3 — fixed in 6.3
How to fix
Upgrade to a fixed version: pi-hole web 6.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-53533 or the next vulnerability affects your stack