This Server‑Side Request Forgery (SSRF) flaw in Drupal’s Freelinking module allows an attacker to instruct the web server to fetch arbitrary URLs. The vulnerability can lead to the disclosure of sensitive internal data, help discover hidden services, or even retrieve administrative interfaces. The module’s inability to validate outbound URLs is classified under CWE‑918.

Drupal Freelinking is affected for all releases from version 0.0.0 up to and including 4.0.3. Users who have installed any of those versions should upgrade or remove the module.

The CVE does not list an EPSS score or KEV status, but the SSRF nature of the flaw carries a moderate‑to‑high exploitation risk. The likely attack vector is a remote attacker submitting a crafted request, after which the module performs an outbound HTTP call that can expose internal network resources. Compromise of internal services may lead to further lateral movement or data exfiltration.