CVE-2026-72574

Katalog CVE

CVSS 6.1 · Medium EPSS 0,42%

Kerentanan Improper Neutralization of HTTP Headers for Scripting Syntax. Skor CVSS 3.1 6.1 (Medium) menurut CNA.

Deskripsi (NVD)

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

Rincian

Terbit di NVD

10 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/picocms/Pico
• https://github.com/picocms/Pico/blob/master/lib/Pico.php
• https://picocms.org