CVE-2009-3781

CVE-2009-3781 describes a critical vulnerability in the FileField 6.x-3.1 module for Drupal, where the filefield_file_download function fails to enforce node-access permissions for private files. This flaw allows unauthenticated remote attackers to bypass security controls and access unauthorized files. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the vulnerability remains a significant risk for affected Drupal installations.