CVE-2026-72574

MEDIUM 6.1

picocms Pico - Host Header Injection Enables Script Source Hijacking

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

CWE	CWE-644
Vendor	picocms
Product	pico
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for picocms pico

Be the first to know when new medium vulnerabilities affecting picocms pico are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

picocms / Pico

0 ≤ 2.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

picocms.org: https://picocms.org github.com: https://github.com/picocms/Pico github.com: https://github.com/picocms/Pico/blob/master/lib/Pico.php

Credits

Nurmurodov Asadbek