CVE-2026-72574: Pico CMS Host Header Injection Vulnerability

CVE-2026-72574 Overview

CVE-2026-72574 is a host header injection vulnerability in picocms/Pico through version 2.1.4. An unauthenticated remote attacker can control the origin of JavaScript and CSS assets loaded by the default theme. The flaw resides in the Pico::getBaseUrl function in lib/Pico.php, which constructs the base URL from unvalidated HTTP request headers when base_url is unset, which is the default configuration. The vulnerability is classified under [CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax].

Critical Impact
An attacker can coerce Pico into rendering pages that load attacker-controlled JavaScript and CSS, enabling client-side script execution against visitors who follow a crafted link.

Affected Products

picocms/Pico versions through 2.1.4
Pico installations using the default theme
Deployments where base_url is left unset in the Pico configuration

Discovery Timeline

2026-08-10 - CVE-2026-72574 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72574

Vulnerability Analysis

Pico is a flat-file content management system written in PHP. The default configuration leaves base_url unset, and the framework computes it dynamically at request time. The Pico::getBaseUrl method in lib/Pico.php reads the Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port HTTP headers to reconstruct the request origin. These headers are attacker-controlled, and Pico does not validate them against an allowlist of trusted hostnames.

The computed base URL is then reflected into rendered pages by the default theme, which uses it to build <script> and <link> element source attributes. When a victim clicks a crafted link that reaches the Pico site through a proxy or via headers manipulated in transit, the resulting page instructs the browser to fetch theme assets from an attacker-controlled host. Because those responses execute in the origin of the Pico site, the attacker gains scripting control in the victim's session.

Root Cause

The root cause is trust in untrusted request metadata. Pico::getBaseUrl treats HTTP headers as authoritative for identifying the deployed hostname, scheme, and port. No allowlist, canonical hostname check, or configuration fallback is enforced when base_url is empty.

Attack Vector

Exploitation requires user interaction, typically the victim clicking a link. The attacker submits a request with headers such as X-Forwarded-Host: attacker.example and X-Forwarded-Proto: https to the Pico endpoint. Pico echoes the attacker-supplied origin into asset URLs in the rendered HTML response. The victim's browser then loads JavaScript from the attacker's host and executes it in the context of the legitimate Pico site. See the PicoCMS source for the affected getBaseUrl implementation.

Detection Methods for CVE-2026-72574

Indicators of Compromise

Web server access logs containing X-Forwarded-Host or X-Forwarded-Proto headers pointing to unexpected external hostnames
Rendered Pico responses in which <script src> or <link href> reference an origin different from the site's canonical hostname
Referrer patterns showing users arriving at Pico URLs from unfamiliar link shorteners or attacker infrastructure

Detection Strategies

Inspect HTTP request headers at the reverse proxy or WAF layer, alerting on Host or X-Forwarded-* values that do not match the site's canonical domain
Enforce a Content Security Policy that restricts script-src and style-src to trusted origins and monitor CSP violation reports
Periodically fetch Pico pages with mutated headers in a synthetic-monitoring job and diff the resulting HTML for injected origins

Monitoring Recommendations

Centralize web server and reverse proxy logs and search for anomalous Host header values reaching the Pico backend
Monitor outbound DNS resolution from client browsers via CSP reports for unexpected asset domains
Track referer and user-agent clustering on Pico endpoints to identify social-engineering campaigns leveraging crafted links

How to Mitigate CVE-2026-72574

Immediate Actions Required

Set the base_url value explicitly in config/config.yml so Pico stops deriving the origin from request headers
Configure the upstream reverse proxy or web server to strip or overwrite X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers from client requests
Deploy a strict Content Security Policy that restricts script-src and style-src to the canonical site origin

Patch Information

At the time of publication, no fixed release beyond Pico 2.1.4 is referenced in the NVD entry. Monitor the PicoCMS GitHub repository for updated releases and security advisories addressing CVE-2026-72574.

Workarounds

Hardcode base_url in the Pico configuration file to the site's canonical HTTPS URL
Terminate TLS and normalize the Host header at a trusted reverse proxy before requests reach Pico
Disable or replace the default theme with one that does not rely on the dynamically constructed base URL for asset references

bash

# Configuration example: pin base_url in config/config.yml
base_url: "https://example.com/"

# nginx: normalize headers before proxying to Pico
proxy_set_header Host example.com;
proxy_set_header X-Forwarded-Host example.com;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;