The only problem I see possible is that you could file snoop the system but this is an really easy problem to fix only let server app send files within web server folder.