UnoPim CVE-2026-102630

Exploitable only when UnoPim (before 2.0.1 / 2.1.1) is deployed behind a shared caching proxy or CDN that caches admin layout responses, because the vulnerable code called trustProxies(at: '*') and honored the X-Forwarded-Host header without validation. The attacker needs no authentication or special privileges to inject the poisoned header, but exploitation depends on two limiting factors: (1) a shared cache must store the attacker-influenced response (reflected in CVSS 4.0 AT:P), and (2) a legitimate administrator must subsequently load the poisoned/cached admin page for the injected JavaScript origin to execute (UI:P). Deployments where admin responses are not cached by a shared proxy, or where the edge already strips X-Forwarded-* headers, are effectively not exploitable.

This is a genuine but conditional flaw, not a high-severity emergency. The vendor CVSS 4.0 base score is only 2.3, driven by AT:P (a specific attack requirement - a shared/caching proxy in front of the app) and UI:P (an administrator must subsequently load the poisoned page), with only subsequent-system impact (SC:L/SI:L) and no direct vulnerable-system impact (VC:N/VI:N/VA:N). PR:N confirms the attacker themselves needs no authentication. No EPSS score is provided, there is no CISA KEV listing, and no public exploit code is referenced - so exploitation status is 'no public exploit identified at time of analysis' despite a VulnCheck advisory documenting the mechanism. The 'RCE' tag overstates the impact: the root cause (CWE-348, trusting X-Forwarded-Host because bootstrap/app.php called trustProxies(at: '*')) yields client-side JavaScript execution in an administrator's authenticated browser session via cache poisoning - a frontend/session-takeover / stored-XSS-class outcome, not server-side remote code execution, which is why the CVSS impact metrics are all N or L. Real-world risk is concentrated on deployments that sit behind a shared caching layer (CDN or reverse proxy that caches admin layout responses); without such caching, the poisoning does not propagate to other admins. Net: legitimate to patch, but a moderate/low priority rather than a critical, and the raw 'RCE' framing should not drive urgency beyond what the CVSS and preconditions justify.

An unauthenticated attacker sends a request to the UnoPim admin login/layout page with a forged X-Forwarded-Host header (e.g. evil.example.com), which the app trusts because it treated all clients as proxies. The response - with the base-url/asset origin rewritten to the attacker's host - is stored by a shared front-end cache, so the next administrator who loads that cached admin page has their browser fetch and execute attacker-controlled JavaScript within their authenticated session. No public PoC is referenced, though VulnCheck has published an advisory describing the cache-poisoning technique.