{"id":"CVE-2026-107310","kind":"vulnerability","aliases":["CVE-2026-107310"],"related":[],"title":"Drupal Freelinking: server-side request forgery lets attackers reach internal hosts","description":"Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.","summary":"The Drupal Freelinking module contains a server-side request forgery flaw, so the Drupal server can be made to send requests to addresses an attacker chooses. The affected versions are listed as 0.0.0 through 4.0.3.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","freelinking","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Freelinking module is installed on the Drupal site, for example with `drush pm:list --filter=freelinking`.\n- Confirm the installed version is above `4.0.3` if the module is present.","fix":null,"status":"open","published_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:24+00:00","updated_at":"2026-10-30T04:31:24+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Drupal Freelinking: server-side request forgery lets attackers reach internal hosts","impact":"medium","summary":"The Drupal Freelinking module contains a server-side request forgery flaw, so the Drupal server can be made to send requests to addresses an attacker chooses. The affected versions are listed as 0.0.0 through 4.0.3.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","freelinking","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server makes requests to internal addresses chosen by an attacker","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the vulnerable input path, and whether authentication is required.","how_to_check":"- Check whether the Freelinking module is installed on the Drupal site, for example with `drush pm:list --filter=freelinking`.\n- Confirm the installed version is above `4.0.3` if the module is present.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Freelinking module installed at a version up to and including 4.0.3 are in scope. The sources do not say which configuration or request path is needed to trigger the flaw, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":4098,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107310':15A,18A '-2026':14A,17A '0.0.0':58B,82C '4.0.3':60B,84C 'address':48B 'affect':53B,78C 'allow':71C 'attack':9A,50B 'choos':51B 'contain':29B 'cve':13A,16A 'drupal':1A,19B,26B,39B,69C 'flaw':36B 'forgeri':7A,35B,65C,75C 'freelink':2A,20B,27B,70C,79C 'host':12A,24B 'intern':11A 'issu':77C 'let':8A 'list':56B 'made':43B 'modul':28B 'packag':21B 'reach':10A 'request':6A,34B,46B,64C,74C 'self':23B 'self-host':22B 'send':45B 'server':4A,32B,40B,62C,72C 'server-sid':3A,31B,61C 'side':5A,33B,63C,73C 'ssrf':66C 'version':54B,80C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Freelinking module installed at a version up to and including 4.0.3 are in scope. The sources do not say which configuration or request path is needed to trigger the flaw, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107310","severity":null,"published_at":"2026-10-30T04:17:58+00:00","modified_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}