CVE-2026-33404

{
  "id": "CVE-2026-33404",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-06T15:17:10.473",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5."
    },
    {
      "lang": "es",
      "value": "La Interfaz de administración de Pi-hole es una interfaz web para gestionar Pi-hole, una aplicación de bloqueo de anuncios y rastreadores de internet a nivel de red. Desde la versión 6.0 hasta antes de la 6.5, los nombres de host del cliente y las direcciones IP de la base de datos FTL se renderizan en el DOM sin escape en network.js (página de Red) y charts.js/index.js (información sobre herramientas de gráficos del Panel de control). Si bien la validación ascendente en dnsmasq y FTL bloquea los caracteres HTML a través de rutas DHCP/DNS normales, la interfaz de usuario web no realiza escape de salida, una inconsistencia con otros campos en el mismo archivo que están correctamente escapados. Esta vulnerabilidad se corrige en la versión 6.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pi-hole",
          "product": "web",
          "versions": [
            {
              "version": ">= 6.0, < 6.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-06T18:39:39.206477Z",
          "id": "CVE-2026-33404",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndIncluding": "6.4.1",
              "matchCriteriaId": "3F1EA9FF-4B56-41DE-A685-A1B75E6ECEF2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pi-hole/web/security/advisories/GHSA-px6w-85wp-ww9v",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}