This vulnerability arises from improper neutralization of HTTP headers (CWE-644) in picocms/Pico through version 2.1.4. Specifically, the Pico::getBaseUrl function in lib/Pico.php builds the base URL using unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers. When base_url is not explicitly set, this allows an attacker to inject a malicious host header, potentially controlling the origin of JavaScript and CSS assets loaded by the default theme, leading to partial compromise of integrity and confidentiality.

An unauthenticated remote attacker can influence the origin of scripts and stylesheets loaded by the default theme, potentially enabling injection of malicious content or manipulation of resources. The CVSS score of 6.1 (medium severity) reflects limited confidentiality and integrity impact without availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider explicitly setting the base_url configuration to a trusted value to avoid reliance on unvalidated headers.