The vulnerability stems from missing access control checks when serving files embedded in published content. File::getURL() likely provided direct access URLs without considering embedded context permissions, while AssetStore::getAsStream() served content without re-validating permissions for the current request context. This allowed protected files to be accessed through published content links despite folder protection settings. The migration task mentioned in SilverStripe's advisory suggests changes to URL generation and access validation patterns.