View online: https://www.drupal.org/sa-contrib-2026-213 Project: Freelinking [1] Project machine name: freelinking Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <4.0.3 || >=5.0.0 <5.0.0-alpha3 CVE IDs: CVE-2026-107310 Description:  This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs. This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk. Solution:  Install the latest version: * If you use the Freelinking module, upgrade to Freelinking 4.0.3 [3] Reported By:  * Marcus Johansson (marcus_johansson) [4] Fixed By:  * Marcus Johansson (marcus_johansson) [5] * Matthew Radcliffe (mradcliffe) [6] Coordinated By:  * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/freelinking [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/freelinking/releases/4.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/mradcliffe [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....