A server-side request forgery (SSRF) vulnerability was discovered in Typecho versions up to 1.3.0. The vulnerability affects the Service::sendPingHandle function in the Ping Back Service Endpoint component. Attackers can manipulate the X-Pingback/link argument to perform SSRF attacks remotely. The exploit has been publicly disclosed and is available for use. The vendor was notified but did not respond to the disclosure.