CVE-2026-72574

Name of the Vulnerable Software and Affected Versions picocms/Pico versions prior to 2.1.5

Description A host header injection issue allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When the base url is unset, the getBaseUrl() function in lib/Pico.php constructs the base URL using unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers. This causes theme url, assets url, and plugins url to point to an attacker-controlled domain, leading the application to load scripts and stylesheets from that external source.

Recommendations Update picocms/Pico to version 2.1.5 or later. Set the base url configuration to a static value to prevent the application from relying on request headers to determine the base URL.