That was my immediate response too, but then I thought there must be protected material in the outer directory. I think really we need more information. Among other things, can the directory structure be rearranged? Putting accessible content inside of inaccessible content doesn't seem the safest.
Granted, every website in the world does the same thing to some extent. Nobody can run wild in the / (physical top level) directory. But here we're on a deeper level.