What is the CVSS score of CVE-2026-72574?

CVE-2026-72574 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-72574?

Yes, a patch is available for CVE-2026-72574. Update the affected software to the latest version immediately.

Pico CMS CVE-2026-72574

EUVD-2026-55232 MEDIUM

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-08-10 TuranSec

GHSA-563g-2g6p-xmpf

PHP Code Injection Pico

6.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable via crafted HTTP headers, no credentials required (PR:N), but a victim must render the page (UI:R); injected scripts execute in the browser security context, warranting S:C with low C and I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:30 vuln.today

DescriptionCVE.org

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl() in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers. The resulting URL propagates to theme_url, assets_url, and plugins_url, causing script and stylesheet tags to load resources from an attacker-controlled domain.

AnalysisAI

Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.

Technical ContextAI

Pico is a flat-file CMS written in PHP. The vulnerable logic resides in Pico::getBaseUrl() within lib/Pico.php (https://github.com/picocms/Pico/blob/master/lib/Pico.php), which constructs the application's base URL by reading HTTP request headers when the base_url directive is absent from config/config.yml - the default shipping state. The derived URL is then assigned to the internal theme_url, assets_url, and plugins_url variables, which are consumed directly by the default Twig theme to emit <script> and <link rel='stylesheet'> tags. CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) identifies the root cause class: header values intended only for routing are incorporated into HTML output without sanitization, enabling external resource injection. The CPE string cpe:2.3:a:picocms:pico:*:*:*:*:*:*:*:* covers all tracked versions, consistent with the through-2.1.4 range stated in the CVE description.

RemediationAI

No vendor-released patched version is confirmed in the available data; the provided references point only to the Pico homepage (https://picocms.org) and the GitHub repository (https://github.com/picocms/Pico) without identifying a specific fixed release - administrators should monitor the repository for a tagged release addressing this issue. As an immediate and fully effective workaround, explicitly set base_url to a hardcoded absolute URL in config/config.yml (for example, base_url: https://example.com) - this bypasses the header-based URL construction entirely and has no functional side effects. For deployments behind a reverse proxy or CDN, configure the proxy to strip and rewrite the X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers from incoming client requests before they reach Pico, preventing header injection regardless of Pico configuration; note that stripping X-Forwarded-Host may affect other applications on the same proxy that rely on it for canonical URL resolution. Setting base_url explicitly in configuration is recommended as a permanent hardening measure even after a patch is released.