{"id":"CVE-2026-7025","title":"Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery","summary":"A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-918"],"product":"Typecho","affected":["Typecho 1.0","Typecho 1.1","Typecho 1.2","Typecho 1.3.0"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-04-27T13:11:52.275557Z"},"exploitAvailable":true,"published":"2026-04-26","updated":"2026-10-27","sourceUpdated":"2026-10-27T13:30:00.271Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-7025","references":[{"url":"https://vuldb.com/vuln/359605","label":"VDB-359605 | Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery"},{"url":"https://vuldb.com/vuln/359605/cti","label":"VDB-359605 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-7025","label":"CVE-2026-7025 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/797772","label":"Submit #797772 | Typecho 1.3.0 and earlier Server-Side Request Forgery"},{"url":"https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF/"},{"url":"https://github.com/typecho/typecho/commit/96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b"},{"url":"https://github.com/typecho/typecho/releases/tag/v1.3.1-rc"},{"url":"https://github.com/typecho/typecho/"}],"tags":["cve.org","exploit-available"],"epss":0.00278,"epssPercentile":0.20136,"ingestedAt":"2026-10-27T16:11:59.348Z","slug":"CVE-2026-7025","body":"## Overview\n\nA vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.1-rc is able to resolve this issue. The patch is identified as 96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b. Upgrading the affected component is advised.\n\n## Affected\n\n- `Typecho 1.0`\n- `Typecho 1.1`\n- `Typecho 1.2`\n- `Typecho 1.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}