CVE-2026-72574CWE-644

CVE-2026-72574

Medium · published August 10, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.3th percentile
Weakness
CWE-644 · Improper Neutralization of HTTP Headers for Scripting Syntax
Published
2026-08-10T15:17Z
References (3)
https://github.com/picocms/Pico · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/picocms/Pico/blob/master/lib/Pico.php · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://picocms.org · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 10 AUG 10:40Z
    picocms Pico - Host Header Injection Enables Script Source Hijacking
    cvelistv5