# CVE-2026-72574

## Summary

- **CVE ID:** CVE-2026-72574
- **Severity:** MEDIUM
- **CVSS Score:** 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **CWE:** CWE-644
- **Published:** Aug 10, 2026
- **Last Modified:** Aug 10, 2026

## Description

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl() in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers. The resulting URL propagates to theme_url, assets_url, and plugins_url, causing script and stylesheet tags to load resources from an attacker-controlled domain.

## Affected Products

- picocms — Pico (0)

## References

- [CNA](https://picocms.org)
- [CNA](https://github.com/picocms/Pico)
- [CNA](https://github.com/picocms/Pico/blob/master/lib/Pico.php)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 15.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._