Pi‑hole’s administrative web interface injects configuration values directly into HTML value attributes without escaping. A double quote in any config value breaks out of the attribute context, enabling arbitrary attribute injection. Because the server’s content‑security‑policy restricts JavaScript execution, the attack is limited to altering element styling for UI redressing, but it does not lead to code execution or data exfiltration.

The flaw resides in the Pi‑hole web interface component, affecting installations using versions 6.0 through 6.4. The vulnerability stems from the /api/config endpoint and the settings‑advanced.js script that processes the returned values. Version 6.5 and later contain the fix.

The CVSS base score is 5.4, indicating a moderate severity risk. The EPSS score is below 1 %, suggesting that wide‑scale exploitation is unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need to supply a malicious teleporter backup file, which is imported through the web interface and bypasses per‑field validation. Therefore the attack vector is user‑initiated import, and the impact is restricted to UI manipulation, without compromising confidentiality or integrity.