By requesting resource like http://[victim_address]/All%20Disk%20Drives/C:/ it's p[ossible to access protected directory.
vulners.com/securityvulns/securityvulns:doc:9256