{"schemaVersion":3,"id":"CVE-2026-26953","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.  Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery’s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1.","dates":{"published":"2026-02-19T22:50:08.429Z","modified":"2026-02-20T15:39:52.782Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00486,"percentile":0.4077,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.18,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00306},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00486,"percentile":0.4077}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00306,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00423,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00433,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00486,"percentile":0.4077}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_PI-HOLE_WEB","name":"Web","source":"github","url":"https://github.com/pi-hole/web/security/advisories/GHSA-7w6h-3gwc-qhq5","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-116","name":"Improper Encoding or Escaping of Output","description":"The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/116.html"}],"affected":[{"vendor":"pi-hole","product":"web","name":"web","label":"web","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.4.1","eol":null,"hubHref":"/vendor/pi-hole/web"},{"vendor":"pi-hole","product":"web_interface","name":"web interface","label":"web_interface","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.0, < 6.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.0, < 6.4.1","eol":null,"hubHref":"/vendor/pi-hole/web_interface"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6","label":"github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6","hostname":"github.com","tags":["X Refsource CONFIRM","Exploit","Vendor Advisory"]},{"url":"https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d","label":"github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d","hostname":"github.com","tags":["X Refsource MISC","Patch"]},{"url":"https://github.com/pi-hole/web/releases/tag/v6.4.1","label":"github.com/pi-hole/web/releases/tag/v6.4.1","hostname":"github.com","tags":["X Refsource MISC","Release Notes"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-02-19T22:50:08.429Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-20T15:39:52.782Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T20:38:27.664Z","stale":false,"partial":false}}