CVE-2026-102630: UnoPim X-Forwarded-Host RCE Vulnerability

CVE-2026-102630 Overview

CVE-2026-102630 is a cache poisoning vulnerability in UnoPim, an open-source Product Information Management (PIM) platform. Affected versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation. Unauthenticated attackers can inject arbitrary origins into admin layout pages, redirecting JavaScript asset loading to attacker-controlled servers. When shared proxies cache the poisoned response, subsequent administrators execute attacker-supplied code inside their authenticated sessions. The weakness is classified as CWE-348: Use of Less Trusted Source.

Critical Impact

A poisoned cache entry can serve attacker-controlled JavaScript to authenticated administrators, enabling arbitrary code execution within admin sessions.

Affected Products

• UnoPim versions 2.0.0 before 2.0.1
• UnoPim versions 2.1.0 before 2.1.1
• UnoPim deployments behind shared or caching proxies

Discovery Timeline

• 2026-09-29 - CVE-2026-102630 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102630

Vulnerability Analysis

UnoPim is built on Laravel and, in vulnerable releases, configures the framework to trust all connecting clients as reverse proxies. The bootstrap/app.php file invokes $middleware->trustProxies(at: '*'), which instructs the framework to accept X-Forwarded-* headers from any source. Because no allowlist of trusted hosts is enforced, the value of X-Forwarded-Host propagates into Laravel's URL generator and, in turn, into Blade layout templates that render script tags for admin pages.

An unauthenticated attacker sends a request with a crafted X-Forwarded-Host header pointing at a server they control. The rendered response embeds asset URLs that resolve to the attacker's origin. When an upstream Content Delivery Network (CDN) or shared HTTP cache stores this response, every administrator that later requests the same admin layout receives the poisoned page. Their browser then fetches JavaScript from the attacker's host and executes it within an authenticated admin session.

Root Cause

The root cause is a combination of implicit trust in forwarded headers and missing host validation. The middleware configuration trusts every proxy, and the affected Blade layout template renders script sources using host-derived URLs without sanitization.

Attack Vector

Exploitation requires only network access to the UnoPim application and, for successful weaponization, the presence of a shared cache in front of the origin. An attacker issues a single unauthenticated request with a malicious X-Forwarded-Host header. Subsequent admin visitors served from the cache execute attacker JavaScript in their browser context, enabling session abuse, admin action forgery, and further compromise.

// Vulnerable configuration in bootstrap/app.php prior to the fix
$middleware->trustProxies(at: '*');

// Patched configuration restricts trusted hosts and proxies
$middleware->trustHosts(at: function () {
    $hosts = [];

    if ($appHost = parse_url((string) config('app.url'), PHP_URL_HOST)) {
        $hosts[] = $appHost;
    }

    $extra = array_filter(array_map('trim', explode(',', (string) env('TRUSTED_HOSTS', ''))));

    return array_values(array_unique(array_merge($hosts, $extra)));
});

$middleware->trustProxies(at: env('TRUSTED_PROXIES', '127.0.0.1'));

Source: GitHub Commit 77e3361

Detection Methods for CVE-2026-102630

Indicators of Compromise

• Inbound HTTP requests containing X-Forwarded-Host headers with values that do not match the configured APP_URL hostname.
• Admin layout responses whose rendered <script src="..."> attributes reference unexpected external hostnames.
• Cached responses in upstream CDN or reverse proxy logs where the Host and X-Forwarded-Host values diverge.
• Outbound browser requests from administrator workstations to unknown domains sourced from /admin pages.

Detection Strategies

• Inspect web server and reverse proxy access logs for anomalous X-Forwarded-Host values on requests to admin routes.
• Compare rendered HTML asset URLs against the expected APP_URL value in monitored synthetic checks of admin pages.
• Audit CDN or shared cache keys to confirm they include the Host header, preventing single-key poisoning across tenants.

Monitoring Recommendations

• Alert on HTTP responses returning admin layout pages that reference cross-origin script sources.
• Monitor for browser errors or Content Security Policy (CSP) violations reported by administrator sessions.
• Track version inventory of UnoPim installations and flag any hosts still running versions before 2.0.1 or 2.1.1.

How to Mitigate CVE-2026-102630

Immediate Actions Required

• Upgrade UnoPim to version 2.0.1 or 2.1.1, or later, as published in the v2.0.1 release and v2.1.1 release.
• Restrict trusted proxies to specific upstream IP addresses using the new TRUSTED_PROXIES environment variable.
• Purge cached admin responses from any CDN or shared HTTP cache after upgrading.

Patch Information

The fix is delivered in commit 77e33618 and included in releases 2.0.1 and 2.1.1. The patch replaces the wildcard trustProxies(at: '*') call with an explicit allowlist sourced from TRUSTED_PROXIES, and adds trustHosts() enforcement bound to APP_URL and an optional TRUSTED_HOSTS list. Requests with unrecognized Host headers are rejected with HTTP 400 by Symfony's underlying validation.

Workarounds

• Configure the upstream reverse proxy or CDN to strip client-supplied X-Forwarded-Host headers before forwarding to UnoPim.
• Add a Web Application Firewall (WAF) rule that blocks requests to /admin paths where the X-Forwarded-Host value does not match the canonical hostname.
• Ensure cache keys at the CDN layer include the Host header so that poisoned entries cannot be served across sessions.

# Configuration example: harden .env after upgrading to 2.0.1 or 2.1.1
APP_URL=https://pim.example.com
APP_ADMIN_URL=admin

# Only these upstream proxies may set X-Forwarded-* headers
TRUSTED_PROXIES=10.0.0.10,10.0.0.11

# Additional hostnames accepted in the Host header (comma-separated)
TRUSTED_HOSTS=pim-internal.example.com

Source: GitHub Commit 77e3361