CVE-2025-59151
CVE-2025-59151 is a high-severity vulnerability in Pi-hole Web Interface with a CVSS 3.x base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-93.
Key facts
- Severity: High (CVSS 3.x base score 8.2)
- EPSS exploit prediction: 0% (32nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-36364
- Weakness: CWE-93
- Affected product: Pi-hole Web Interface
- Published:
- Last modified:
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.
Frequently asked questions
- What is CVE-2025-59151?
- Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.
- How severe is CVE-2025-59151?
- CVE-2025-59151 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability low.
- Is CVE-2025-59151 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-59151?
- CVE-2025-59151 affects Pi-hole Web Interface. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-59151?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-59151 have an EU (EUVD) identifier?
- Yes. CVE-2025-59151 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-36364.
- When was CVE-2025-59151 published?
- CVE-2025-59151 was published on 2025-10-27 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*
More vulnerabilities in Pi-hole Web Interface
- CVE-2026-33765 — Critical (CVSS 9.8): Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…
- CVE-2023-23614 — High (CVSS 8.8): Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and…
- CVE-2021-29448 — High (CVSS 7.6): Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the…
- CVE-2021-3706 — High (CVSS 7.5): adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
- CVE-2021-41175 — High (CVSS 7.3): Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the…
- CVE-2026-33403 — Medium (CVSS 6.1): Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…
All CVEs affecting Pi-hole Web Interface →
Other CWE-93 (CRLF Injection) vulnerabilities
- CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
- CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…
- CVE-2026-11362 — Critical (CVSS 9.8): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not…
- CVE-2025-40671 — Critical (CVSS 9.3): SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve,…
- CVE-2026-11373 — Critical (CVSS 9.1): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for…
- CVE-2026-50638 — Critical (CVSS 9.1): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd…