CVE-2026-33403

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.0 through 6.4

Description A reflected DOM-based XSS (Cross-Site Scripting) issue exists in taillog.js. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the file query parameter is interpolated into an innerHTML assignment without proper escaping. Additionally, the Content-Security-Policy lacks a form-action directive, which allows injected <form> elements to exfiltrate credentials to an external origin.

Recommendations Update to version 6.5.