Security Hole or false alarm?

I am running a NetWare 5 network with a website hosted externaly. There is no firewall currently set up for the network here but is at the provider. Recently a user posted a file to the website. He didn’t however upload the document, so it pointedto the server for the file. After correcting this (he uploaded the file), you can still see the path on the server where the file is located in the address/location bar on the browser.
My question is this:
Even though I can’t access anything by selecting a different directory, how much of a threat is that and is there any way to prevent that from showing up? Any suggestions would be appreciated.