CVE-2026-72574: Picocms Pico

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

Affected products

• Picocms Pico: up to and including 2.1.4

Published 2026-08-10. Last modified 2026-09-03.