PatchClock

PHP security digest · 7 Oct 2026

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently p...

Unrated CVE-2026-107310

Package
drupal/freelinking
Fixed in
4.0.3
Published
Wed 7 Oct 2026, 17:38 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The Freelinking module can expose page titles for certain privately accessible URLs. An attacker must have access to a text format with the Freelinking plugin configured to allow privately accessible external URLs to be crawled.

Am I affected?

Look for drupal/freelinking and its version in composer.lock. The advisory lists 4.0.3 as fixed but gives no affected version range. Check whether any text format uses the Freelinking plugin with crawling of privately accessible external URLs allowed, and who has access to use that format.

What to do

Check which version you have, then update to a fixed release for your branch (4.0.3):

composer show drupal/freelinking | grep versions
composer update drupal/freelinking

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Disable the functionality that allows privately accessible external URLs to be crawled while evaluating the risk.

The advisory's description

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content.

The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs.

This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.