CVE-2026-33403

Pi-hole Admin Interface versions 6.0 through 6.4 contain a reflected DOM-based cross-site scripting (XSS) vulnerability in the taillog.js file that allows unauthenticated attackers to inject arbitrary HTML by crafting malicious URLs. The vulnerability exists because the file query parameter is interpolated into an innerHTML assignment without proper escaping, and the Content-Security-Policy lacks a form-action directive, enabling attackers to inject malicious form elements that can exfiltrate user credentials to external sites. The vulnerability carries a CVSS v3.1 score of 6.1 (MEDIUM) with a network attack vector requiring only user interaction, resulting in low confidentiality and integrity impact. Exploitation requires no special complexity or privileges, though it depends on user engagement with a crafted link. The vulnerability is not currently listed in the Known Exploited Vulnerabilities catalog and shows minimal community attention with an EPSS score of 0.00065, indicating low exploitation probability in the wild. Pi-hole released version 6.5 to address this issue, and users should update immediately to mitigate the risk of credential theft through social engineering attacks.