While reading the https://www.virtualmin.com/comment/791495 I was presented an "Add new comment" form with the list of the files attached to the node by another user. So I tried to remove the files on the comment form and submitted it (https://www.virtualmin.com/comment/791495#comment-791495) and the files were gone. That's definitely a very serious issue. Please fix permissions so attached files could be managed only by admins and, if necessary, maybe the node author himself.
Users are able to remove files attached by other users