The flaw allows an attacker to manipulate the X‑Pingback/link header to cause the Typecho server to send arbitrary HTTP requests on the server’s behalf. This server‑side request forgery could allow remote attackers to access internal services, exfiltrate data, or perform denial‑of‑service by flooding outbound connections, all without possessing authentication credentials.

Typecho versions up to 1.3.0 are affected, specifically the Service::sendPingHandle function within var/Widget/Service.php of the Ping Back Service Endpoint component. No newer releases are mentioned in the advisory, so current installations of 1.3.0 or earlier remain vulnerable.

The CVSS score of 6.9 indicates a medium severity. The EPSS of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the event is triggered by an HTTP request from a client that supplies an arbitrary link header. Successful exploitation would require the application to be reachable from the network and the attacker to supply a crafted X‑Pingback/link value.