CVE-2026-72574

Published: Aug 10, 2026Modified: Sep 3, 2026Deferred

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (Secondary)

Description

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

Related CWEs

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

References (3)

https://github.com/picocms/Pico

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

https://github.com/picocms/Pico/blob/master/lib/Pico.php

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

https://picocms.org

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Timeline

No history available yet.