Description

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl() in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers. The resulting URL propagates to theme_url, assets_url, and plugins_url, causing script and stylesheet tags to load resources from an attacker-controlled domain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-10T11:17:30.137Z",
  "pubdate": "2026-08-10T11:17:30.137Z",
  "executiveSummary": "A host header injection vulnerability exists in picocms/Pico through version 2.1.4, allowing unauthenticated remote attackers to control the origin of JavaScript and CSS assets loaded by the default theme. The vulnerability arises when the base_url configuration parameter is unset, which is the default installation state. Under this condition, the application dynamically constructs the base URL utilizing unvalidated HTTP request headers, including Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port. The impact of this flaw is severe, as the improperly sanitized URL propagates directly into the theme_url, assets_url, and plugins_url parameters. Consequently, an attacker can manipulate these values to force victim browsers to load malicious scripts and stylesheets from an attacker-controlled domain, leading to potential cross-site scripting (XSS), arbitrary code execution within the context of the user session, and content spoofing. Exploitation requires network exposure and the ability to send crafted HTTP requests with manipulated headers to the targeted Pico instance, while operating without any prior authentication or special privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the Pico::getBaseUrl() method located within the lib/Pico.php file. When the configuration variable base_url is left unset, the application attempts to auto-discover the base URL of the installation by parsing incoming HTTP request headers. Specifically, it trusts and processes the unvalidated Host header alongside proxy-related headers such as X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request directed at the vulnerable Pico instance. Within this request, the attacker injects malicious values into the Host header or the X-Forwarded-Host header, pointing to a server under their direct control. Because the application fails to validate or sanitize these headers against a trusted whitelist or configuration baseline, Pico::getBaseUrl() incorporates the attacker-supplied domain into the generated base URL string.\nThe resulting poisoned URL does not remain isolated; it propagates through the application's environment and is assigned to critical asset-loading variables such as theme_url, assets_url, and plugins_url. When a victim subsequently visits the compromised site, the rendered HTML document contains script and stylesheet tags that reference the attacker-controlled domain instead of the legitimate application origin.\nThe payload behavior involves the browser executing external JavaScript files and applying CSS stylesheets served from the attacker's infrastructure. This enables the attacker to hijack the Document Object Model (DOM), steal sensitive session tokens, capture user input, or deface the rendered web pages. The vulnerable component is the URL resolution logic inside lib/Pico.php affecting picocms/Pico versions through 2.1.4. The vulnerability is exploitable over the network by unauthenticated remote attackers with zero prior privileges, provided that the base_url setting has not been explicitly defined by the system administrator."
}