CVE-2025-32785 Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
An authenticated user can inject malicious JavaScript into the Address field, which executes when another user updates the gravity database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-32785?
CVE-2025-32785 is a low-severity cross-site scripting vulnerability in pi-hole web, published on 27 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
Weakness: CWE-79
Which versions are affected by CVE-2025-32785?
It affects 1 product.
Products include Pi-Hole Web Interface.
How do I fix CVE-2025-32785?
No fix has been published for CVE-2025-32785 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-32785 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32785 exists.
Other vulnerabilities in pi-hole web
- CVE-2026-33765 Pi-hole Web Interface has a Command Injection Vulnerability
- CVE-2023-23614 Improper session handling of "Remember me for 7 days" functionality
- CVE-2025-59151 Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
- CVE-2021-3706 Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
- CVE-2021-41175 Stored XSS in Client Groups Management (Authenticated)
Sources
Also known as GHSA-7w6h-3gwc-qhq5.