Live › vulnerability › CVE-2026-107310
The Drupal Freelinking module contains a server-side request forgery flaw, so the Drupal server can be made to send requests to addresses an attacker chooses. The affected versions are listed as 0.0.0 through 4.0.3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Freelinking module installed at a version up to and including 4.0.3 are in scope. The sources do not say which configuration or request path is needed to trigger the flaw, so the exposure of any given site is unknown.
No product ranges from the sources yet.
drush pm:list --filter=freelinking.4.0.3 if the module is present.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-107310")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.