CVE-2026-72574: picocms Pico - Host Header Injection Enables Script Source Hijacking
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.
Other sources
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset (the default), Pico::getBaseUrl() in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers. The resulting URL propagates to themeurl, assetsurl, and pluginsurl, causing script and stylesheet tags to load resources from an attacker-controlled domain.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72574?
The severity of CVE-2026-72574 is rated as medium with a score of 6.1.
What does CVE-2026-72574 exploit in PicoCMS?
CVE-2026-72574 exploits a host header injection vulnerability that allows an attacker to control the origin of JavaScript and CSS assets.
How can I mitigate the risk of CVE-2026-72574?
To mitigate the risk of CVE-2026-72574, ensure that the base_url is properly configured and validate inputs to avoid host header injection.
Who is affected by CVE-2026-72574?
Any user of PicoCMS version 2.1.4 and earlier is affected by CVE-2026-72574 due to the default settings allowing host header injection.
Can CVE-2026-72574 lead to script source hijacking?
Yes, CVE-2026-72574 can lead to script source hijacking due to the allowance of controlled origins for loaded assets.