Comment by cesnja

You can still get hit by a path traversal exploit. The safest option is to only have the public files on the server.