Description
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.1-rc is able to resolve this issue. The patch is identified as 96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b. Upgrading the affected component is advised.
Published: 2026-04-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Patch
AI Analysis

Impact

A flaw exists in Typecho up to version 1.3.0 that allows an attacker to send a crafted X‑Pingback/link header to the Service::sendPingHandle method in var/Widget/Service.php. The manipulation of this header triggers an outbound HTTP request to an arbitrary URL specified by the attacker, enabling server‑side request forgery (SSRF). This weakness can be used to reach internal network resources, access restricted services, or potentially execute code on downstream systems, depending on how the application or network is configured. The vulnerability is identified as CWE‑918.

Affected Systems

Any installation of Typecho whose version is 1.3.0 or earlier is vulnerable. The affected component is the Ping Back Service Endpoint, specifically the Service::sendPingHandle function found in var/Widget/Service.php. The vendor supply a patch in release candidate 1.3.1‑rc, with commit hash 96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b, that resolves the SSRF issue.

Risk and Exploitability

The CVSS score is 6.9, indicating medium severity. The EPSS score is below 1 %, suggesting a low probability of active exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by directing an HTTP request containing a malicious X‑Pingback/link header to the vulnerable endpoint. Successful exploitation requires the application to be publicly reachable and the attacker to craft the header with a target of choice. While the risk level is moderate, the low exploitation likelihood mitigates immediate concern, but the potential impact warrants prompt remediation.

Generated by OpenCVE AI on October 27, 2026 at 15:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Typecho to version 1.3.1‑rc or later to apply the vendor‑supplied SSRF fix
  • If an upgrade is delayed, remove or disable the Ping Back Service Endpoint by blocking the /service/ping route or commenting it out in the application’s routing configuration
  • Configure outbound request filtering or a proxy so that the application only reaches whitelisted external destinations, limiting the scope of any SSRF attempt
  • Consider monitoring outbound HTTP traffic for unexpected internal or privileged requests to detect potential abuse

Generated by OpenCVE AI on October 27, 2026 at 15:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.1-rc is able to resolve this issue. The patch is identified as 96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b. Upgrading the affected component is advised.
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

Mon, 27 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 26 Apr 2026 07:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery
First Time appeared Typecho
Typecho typecho
Weaknesses CWE-918
CPEs cpe:2.3:a:typecho:typecho:*:*:*:*:*:*:*:*
Vendors & Products Typecho
Typecho typecho
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Typecho Typecho
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T13:30:00.271Z

Reserved: 2026-04-25T14:11:33.523Z

Link: CVE-2026-7025

cve-icon Vulnrichment

Updated: 2026-04-27T13:11:55.934Z

cve-icon NVD

Status : Deferred

Published: 2026-04-26T08:16:00.227

Modified: 2026-10-27T14:17:01.367

Link: CVE-2026-7025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T15:15:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)