The Vrm 360 3D Model Viewer WordPress plugin up to and including 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
maurice vrm360