Freelinking: This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. (CVE-2026-107310)

The Drupal Freelinking module (versions prior to 4.0.3) contains a vulnerability where it insufficiently restricts viewing of page titles for certain URLs that are meant to be privately accessible. This occurs because the module's input filter allows users to create links that can expose page titles of these URLs. Exploitation requires the attacker to have access to a text format with the Freelinking plugin configured to crawl privately-accessible external URLs, limiting the attack surface. The vulnerability is mitigated by this access requirement. A fix has been released in version 4.0.3.

An attacker with appropriate access can view page titles of URLs that are intended to be private, potentially exposing sensitive information about site content or external resources. However, exploitation is limited by the need for the attacker to have access to a specific text format configuration, reducing the risk of widespread impact.

A patch is available in version 4.0.3 of the Freelinking module. Site administrators should upgrade to this version to remediate the vulnerability. Alternatively, administrators may disable the functionality that allows crawling of privately-accessible external URLs to evaluate and reduce risk.