CVE-2026-7025

Typecho up to 1.3.0 is affected by a server-side request forgery in the Ping Back Service Endpoint: the function Service::sendPingHandle (var/Widget/Service.php). The X-Pingback/link parameter manipulation triggers SSRF, enabling remote access. Exploit publicly available; vendor not responsive to...

CVE-2026-7025: Server-Side Request Forgery (SSRF)

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...