
I came across with an issue in one of the Drupal site that if an anonymous users knows the path of the file(example.org/sites/default/files/file1), he can view as well as download the file without any access to site. This looked strange as the sites files are been traced out by anonymous users and can breakout site admin credentials which are private.