CVE-2026-72574
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A host header injection vulnerability in Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme when base_url is unset.
Risk Assessment
An attacker can alter asset URLs, potentially leading to malicious code injection or data theft.
Recommendation
Update Pico to the latest version or explicitly set base_url in the configuration.
Original NVD description (English source)
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.