CVE-2021-41175 Stored XSS in Client Groups Management (Authenticated)
An authenticated attacker can inject malicious scripts via the client groups management page, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-41175?
CVE-2021-41175 is a high-severity cross-site scripting vulnerability in pi-hole AdminLTE, published on 26 Oct 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
Weakness: CWE-79
Which versions are affected by CVE-2021-41175?
It affects 1 product.
Products include Pi-Hole Web Interface.
How do I fix CVE-2021-41175?
No fix has been published for CVE-2021-41175 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-41175 being exploited?
There is no known exploitation of CVE-2021-41175 in the wild and no public exploit code.
Other vulnerabilities in pi-hole AdminLTE
- CVE-2026-33765 Pi-hole Web Interface has a Command Injection Vulnerability
- CVE-2023-23614 Improper session handling of "Remember me for 7 days" functionality
- CVE-2025-59151 Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
- CVE-2021-3706 Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
- CVE-2021-3811 Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
Sources
Also known as GHSA-mhr8-7rvg-8r43.