CVE-2026-102630 in UnoPim
Summary
by MITRE • 09/29/2026
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
UnoPim versions prior to 2.0.1 and 2.1.1 contain a critical security flaw rooted in the improper validation of HTTP headers used for proxy configuration. The application logic blindly trusts all connecting clients as legitimate proxies, specifically honoring the X-Forwarded-Host header without performing any form of origin verification or sanitization. This architectural oversight allows unauthenticated attackers to manipulate how the server constructs URLs and redirects traffic by injecting arbitrary values into this header during initial requests.
The technical mechanism of exploitation involves an attacker setting the X-Forwarded-Host header to a domain under their control when interacting with the UnoPim application. Because the software relies on this header to determine the base URL for generating links within admin layout pages, it incorporates the malicious value directly into the HTML response sent back to the client. This results in the generation of absolute URLs that point to attacker-controlled infrastructure rather than the legitimate server domain.
The operational impact is severe due to the potential for cached responses on shared proxy servers or CDNs commonly used in web hosting environments. When a request containing the malicious X-Forwarded-Host header triggers a response, and if this response is subsequently cached by an intermediate caching layer, that poisoned cache entry can be served to other users without re-evaluating the original headers. Consequently, when legitimate administrators access their authenticated sessions through these shared proxies, they receive HTML pages with JavaScript asset sources pointing to the attacker's server.
This scenario facilitates a stored cross-site scripting attack vector where malicious scripts are executed within the context of the administrator's trusted session. Since the code runs in an elevated privilege environment, attackers can perform actions such as stealing administrative cookies, capturing sensitive data, modifying product information, or creating backdoor accounts. The persistence of this vulnerability is amplified by caching mechanisms that do not differentiate between requests based on dynamic header values unless explicitly configured to vary cache keys accordingly.
From a classification perspective, this vulnerability aligns with CWE-918, which addresses the Server-Side Request Forgery (SSRF) flaws related to improper validation of server-generated URLs, and more specifically relates to CWE-74 for injection vulnerabilities in XML or HTML contexts when script execution is enabled. In terms of tactical mapping under MITRE ATT&CK, this behavior corresponds to T1059 Command and Scripting Interpreter through the execution of malicious JavaScript payloads within a browser environment, leveraging the trusted context of an authenticated administrative session.
To mitigate this vulnerability, organizations must upgrade UnoPim to version 2.0.1 or later where these header validation checks have been implemented. For systems that cannot be immediately upgraded, administrators should configure web servers and reverse proxies to strip or ignore the X-Forwarded-Host header if it is not strictly required for legitimate proxy functionality. Additionally implementing strict Content Security Policy headers can help mitigate the impact of any injected scripts by restricting sources from which JavaScript assets are allowed to load. Ensuring that caching layers do not cache responses based on unvalidated user-supplied input in critical security contexts is also essential to prevent the propagation of poisoned content to other users.