A host header injection flaw in Pico versions up to 2.1.4 lets an unauthenticated attacker manipulate the base URL constructed by Pico when the base_url setting is unset. By sending crafted Host, X‑Forwarded‑Host, X‑Forwarded‑Proto, or X‑Forwarded‑Port headers, the attacker can force the application to build an external base URL that is then used for theme, asset, and plugin URLs. As a result the site’s theme will load JavaScript and CSS from a domain under the attacker’s control, enabling arbitrary script or style injection and raising the possibility of cross‑site scripting, phishing, or even remote code execution in visitors’ browsers.

picocms Pico, versions up to and including 2.1.4, where the base_url configuration is not set. The vulnerability is present in all installations that use the default configuration and rely on host header information to build URLs.

The CVSS score of 6.1 indicates a moderate impact with potential high consequences if combined with other flaws. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The likely attack vector is remote HTTP request header manipulation, requiring the attacker to control the Host header of a request to the target server. An unauthenticated attacker can exploit this by sending a crafted request to any public URL that the Pico site serves, causing browsers visiting the site to load resources from the attacker‑controlled domain.