CVE-2026-72574: CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax in picocms Pico
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.
AI Analysis
Technical Summary
This vulnerability in picocms/Pico (through 2.1.4) involves improper neutralization of HTTP headers for scripting syntax (CWE-644). When the base_url configuration is unset, the function Pico::getBaseUrl() constructs the base URL using unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers. This manipulated base URL propagates to theme_url, assets_url, and plugins_url, causing script and stylesheet tags in the default theme to load resources from domains controlled by an attacker. This can lead to partial compromise of confidentiality and integrity via injection of malicious scripts or styles.
Potential Impact
An unauthenticated remote attacker can control the origin of JavaScript and CSS assets loaded by the default theme, potentially leading to injection of malicious scripts or styles. The CVSS score of 6.1 (medium severity) reflects limited confidentiality and integrity impact without availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider setting the base_url configuration explicitly to avoid reliance on untrusted HTTP headers. Avoid exposing the application behind proxies that allow manipulation of Host or related headers.
CVE-2026-72574: CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax in picocms Pico
Description
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.
CVSS v3.1
Score 6.1medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in picocms/Pico (through 2.1.4) involves improper neutralization of HTTP headers for scripting syntax (CWE-644). When the base_url configuration is unset, the function Pico::getBaseUrl() constructs the base URL using unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers. This manipulated base URL propagates to theme_url, assets_url, and plugins_url, causing script and stylesheet tags in the default theme to load resources from domains controlled by an attacker. This can lead to partial compromise of confidentiality and integrity via injection of malicious scripts or styles.
Potential Impact
An unauthenticated remote attacker can control the origin of JavaScript and CSS assets loaded by the default theme, potentially leading to injection of malicious scripts or styles. The CVSS score of 6.1 (medium severity) reflects limited confidentiality and integrity impact without availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider setting the base_url configuration explicitly to avoid reliance on untrusted HTTP headers. Avoid exposing the application behind proxies that allow manipulation of Host or related headers.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TuranSec
- Date Reserved
- 2026-08-10T10:32:53.854Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a79ae6fbf8831d5398afd27
Added to database: 08/10/2026, 10:56:47 UTC
Last enriched: 08/10/2026, 11:13:33 UTC
Last updated: 08/10/2026, 18:42:03 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.