# CVE-2025-59151: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker…

Source: https://junglewise.ai/threats/cve-2025-59151-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-27  
License: CC BY 4.0 with a link back

CVE-2025-59151 · Severity: high · CVSS 8.2 · Published 2025-10-27

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.

Technologies: [Pi-hole Web Interface](https://junglewise.ai/threats/technologies/pi-hole-web-interface). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole).

## Quick answers

**Is CVE-2025-59151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59151 being exploited in the wild.

**How severe is CVE-2025-59151?** High severity, with a CVSS score of 8.2, published 27 October 2025.

**Which products and versions are affected?** Pi-hole Web Interface. The advisory does not name versions.

**Is there a fix for CVE-2025-59151?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59151?** Check whether you run Pi-hole Web Interface. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Pi-hole Web Interface

## Related threats

- [Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…](https://junglewise.ai/threats/cve-2026-33405-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a)
- [Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…](https://junglewise.ai/threats/cve-2026-33406-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a)
- [Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…](https://junglewise.ai/threats/cve-2026-33404-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a)
- [Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…](https://junglewise.ai/threats/cve-2026-33403-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a)
- [Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking…](https://junglewise.ai/threats/cve-2026-33765-pi-hole-admin-interface-is-a-web-interface-for-managing-pi-hole-a)