CVE-2026-72574

The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...