EUVD-2026-113562
GHSA-p6fh-9484-jwr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with content-authoring rights
-
ExploitInject crafted Freelinking syntax into content
-
ExecutionFreelinking filter issues server-side request
-
ImpactReach internal resource and leak limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Freelinking module to be installed and its filter enabled on at least one active text format, plus an authenticated account with permission to create or edit content that passes through that filter (PR:L). The attacker must be able to supply Freelinking syntax that the server resolves into an outbound request. Limiting factors: the attack is gated behind authentication and content-authoring privileges, the Freelinking filter must be enabled (not a core-default configuration), impact is confidentiality-only and partial (C:L, no integrity or availability), and no automatable/mass exploitation path is indicated (SSVC Automatable=no). |
| Impact | This is a genuinely low-priority issue that is correctly rated as low-to-moderate, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only limited confidentiality impact and no integrity or availability impact. The EPSS score of 0.14% (4th percentile) is very low, and the SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=partial. No CISA KEV listing is present in the input, and no proof-of-concept or exploit reference is supplied. There is no conflict between signals here - every source points the same direction (low real-world risk), and the vuln.today decision label of 'this_month' reflects routine patching urgency rather than emergency action. The main caveat is the generic nature of the public description: it confirms SSRF (CWE-918) but does not describe the trigger mechanism, so the precise confidentiality exposure must be inferred from the module's function rather than from stated evidence. |
| Exploit ScenarioDerived | An authenticated Drupal user who holds permission to author or edit content on a site where the Freelinking input filter is enabled submits content containing crafted Freelinking syntax that resolves to an attacker-chosen URL. When the filter processes this content, the Drupal server issues a request to that URL, letting the attacker reach internal network endpoints or cloud metadata services and observe limited response data. No public exploit code or PoC reference is provided in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Server-side request forgery in the Drupal Freelinking contrib module allows an authenticated user with permission to create or edit content - and only when the Freelinking filter is enabled on an active text format - to make the Drupal site issue attacker-influenced outbound requests, with partial confidentiality impact and no integrity or availability effect. All releases from 0.0.0 through 4.0.3 are in scope, and the vendor has published a security advisory with a fix. Risk signals are consistently low: EPSS 0.14% (4th percentile), SSVC exploitation none and automatable no, and no public exploit identified at time of analysis, so this fits a this_month remediation cadence rather than emergency response.
RemediationAI
Apply the vendor fix documented in Drupal security advisory SA-CONTRIB-2026-213 (https://www.drupal.org/sa-contrib-2026-213); the affected range runs through 4.0.3, so the patched release is a version later than 4.0.3 and the advisory should be consulted for the exact target release before upgrading the module on each site. Because exploitation requires the Freelinking filter to be enabled on an active text format, disabling that filter on all text formats removes the exposure immediately and is the most reliable interim control, at the cost of losing Freelinking's wiki-style link rendering for content authors. Tightening permissions so that only trusted roles can create or edit content that passes through a Freelinking-enabled format reduces the authenticated attack surface (the vector is PR:L) but does not eliminate the flaw. On sites where the module is not actively used, uninstalling it removes the attack path entirely. Additionally, restricting outbound network egress from the Drupal web server to required destinations limits what an SSRF primitive can reach, with the trade-off that legitimate outbound integrations must be allow-listed. Patch availability is confirmed per the vendor advisory; no public exploit code was identified at time of analysis, so these steps can be scheduled in the normal monthly patch window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Freelinking is a Drupal contributed module (not Drupal core) that extends text filters so authors can write wiki-style link syntax inside body text; the filter parses that syntax server-side and resolves it, which in affected releases can result in the server performing an outbound request to a destination influenced by the content author. The root cause is CWE-918 (Server-Side Request Forgery): the module does not sufficiently constrain the target of the request before it is issued from the web server's network position, so responses or response characteristics can leak limited information back to the author (CVSS C:L with no I or A impact). The CPE cpe:2.3:a:drupal:freelinking:*:*:*:*:*:*:*:* confirms that the affected component is the module itself across its version line rather than a Drupal core subsystem. Reachability is configuration-dependent: the module must be installed and its filter must be enabled on at least one active text format, and the attacker needs an authenticated account able to author or edit content passing through that format (PR:L per the CVSS vector), which is why the score lands at 4.3 rather than in the high range typical of unauthenticated SSRF. Exploitation behaviour, including whether a blind or fully read-capable SSRF primitive results and exactly which syntax triggers resolution, is not described in the available sources; SSVC marks the issue as not automatable.
Know when Freelinking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but requires an authenticated content author (PR:L) to supply filtered input; SSRF yields limited confidentiality only, with no integrity or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Freelinking
View allThe freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access pe
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.0.0 before 4.0.1. Rated medium seve
Exploit-DB