Pi-hole Admin Interface versions 6.0 to before 6.5 improperly neutralize input when generating web pages by placing configuration values directly into HTML value attributes without escaping. This allows an attacker to inject malicious HTML attributes by including double quotes in config values, breaking out of the attribute context. While the server's CSP prevents execution of injected JavaScript, the injected attributes can alter element styling, potentially enabling UI redressing attacks. The vulnerability can be exploited by importing a crafted teleporter backup that circumvents per-field validation. The issue is resolved in version 6.5 of Pi-hole.

The vulnerability allows an attacker to inject arbitrary HTML attributes into the Pi-hole web interface, which can be used to manipulate the user interface appearance (UI redressing). Although direct JavaScript execution is blocked by the server's CSP, the altered styling could mislead users or facilitate phishing-like attacks within the interface. The attack requires user interaction to import a malicious teleporter backup. There are no known exploits in the wild as of the published date.

This vulnerability is fixed in Pi-hole version 6.5. Users should upgrade to version 6.5 or later to remediate this issue. Since no official patch link or advisory is provided, users should verify the upgrade from the official Pi-hole release notes or website. Until upgrading, avoid importing teleporter backups from untrusted sources to reduce risk.