Template:Uploaded-files-access-restriction-info

Setting the user right 'read' to false only restricts access to wiki pages (such as articles and talk pages). Uploaded files (including images, files, docs) under the $wgUploadPath subdirectories will always remain publicly accessible via direct URL access by default.
To restrict access to uploaded files, refer to the instructions in Manual:Image authorization and img_auth.php .