CVE-2025-59151 Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
Attackers can inject CRLF characters to manipulate HTTP headers, enabling session fixation and bypassing browser security controls in Pi-hole Admin Interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59151?
CVE-2025-59151 is a high-severity vulnerability in pi-hole web, published on 27 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.
Which versions are affected by CVE-2025-59151?
It affects 1 product.
Products include Pi-Hole Web Interface.
How do I fix CVE-2025-59151?
No fix has been published for CVE-2025-59151 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59151 exists.
Other vulnerabilities in pi-hole web
- CVE-2026-33765 Pi-hole Web Interface has a Command Injection Vulnerability
- CVE-2023-23614 Improper session handling of "Remember me for 7 days" functionality
- CVE-2021-3706 Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
- CVE-2021-41175 Stored XSS in Client Groups Management (Authenticated)
- CVE-2021-3811 Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
Sources
Also known as GHSA-5v79-p56f-x7c4.