CVE-2026-102630: UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UnoPimto a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
UnoPimto a version that resolves this vulnerability.Fixed in 2.1.1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments of UnoPim 2.0.0 before 2.0.1 or 2.1.0 before 2.1.1 are affected because they trust all connecting clients as proxies. Risk is especially significant where shared proxies cache affected admin layout responses, allowing a poisoned response to reach later administrators.
What does an attacker need to exploit it?
An attacker does not need authentication, but must be able to send a request with a crafted X-Forwarded-Host header. Exploitation also requires an administrator to load a cached poisoned admin page, causing JavaScript assets to be loaded from the attacker-controlled origin.
How can the issue be remediated?
Upgrade affected 2.0.0 installations to 2.0.1 or later, and affected 2.1.0 installations to 2.1.1 or later. The available fix is intended to prevent unvalidated X-Forwarded-Host handling by clients that are not trusted proxies.