Something odd is going on.

 

If I give "Unauthenticated" users edit permission on a text html module, they can edit it with the editor, but if they want to insert an image they can see all the way back to root.

 

If logged in as administrator you can only see the "uploads" folder.