Host Header Injection in PicoCMS

Executive Summary

CVE-2026-72574 is a host header injection vulnerability in Pico CMS versions up to 2.1.4. It allows an unauthenticated remote attacker to manipulate the Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers to control the origin of JavaScript and CSS assets loaded by the default theme. This occurs because Pico::getBaseUrl() in lib/Pico.php builds the base URL from these unvalidated headers when base_url is unset.

Useful 0 Not Useful 0

Detection Guidance

To detect host header injection in Pico CMS, monitor HTTP request headers like Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port for unusual or attacker-controlled values. Check server logs for requests with these headers pointing to external domains. Inspect HTML responses for dynamically loaded assets (CSS/JS) referencing unexpected origins.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to load malicious resources from a domain they control, potentially leading to session hijacking, data theft, or defacement of the website. Since the vulnerability affects theme and asset URLs, it could compromise the integrity of the site's appearance and functionality without requiring authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, triggering compliance violations and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Pico CMS to version 2.1.5 or later to patch the vulnerability. If upgrading is not possible, implement input validation to sanitize Host and X-Forwarded-* headers. Configure your web server to ignore untrusted headers and set a default base URL. Disable the default theme if unused or replace it with a patched version.

Useful 0 Not Useful 0