In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL.
CVSS 3.1MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.01203·Published 2019-09-26·Fixed in 4.3.5, 4.4.4CWE-200