If someone is able to post on the forum of my website links to executable files (malware) hosted on remote websites: can we say that my website suffers from a security hole ?
If you are simply talking about someone posting a link on your forum maliciously (in other words intended to actually hurt the end-user not for sharing between security professionals) I would not necessarily consider it a security hole. I would, however, inform your visitors that they are leaving your site and you have no way of knowing if the site is safe. This is probably the route I would take.
You could also try and a script that would scan the link and make sure it is not an executable using CURL. If I went this route I would probably white-list Content-Types to: html and image types and still display a warning as it is not fool-proof.
Fleche gave a good answer, and I advise you read it too. I would also like to point out that most websites that allow links to other websites do it without any kind of warning. So, you should be okay to do the same. The only places I've seen diferenet are places like oDesk.
A link by itself doesn't do anything. The question is how your webserver reacts to the request.
If the server simply sends the file content to the client, this doesn't cause any trouble (at least for the server). It's just a static file. But if the file gets executed by the server, then you have a problem. This depends on the webserver configuration. For example, a file ending with “.php” might be regarded as a PHP script and run on each request.