CVE-2026-72574

The record

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

Affected packages

Related vulnerabilities

• CVE-2026-67179 Genkit does not properly validate host request headers. CWE-644
• CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding… CWE-644
• CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS… CWE-644
• CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. CWE-644
• CVE-2026-21762 HCL DevOps Loop is affected by missing HTTP security headers. CWE-644
• CVE-2026-54477 The admin panel lacks standard security headers, enabling clickjacking and cross-site… CWE-644
• CVE-2024-51454 IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through… CWE-644
• CVE-2026-4096 IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by… CWE-644