• Go to http://YOURMOODLEURL/course/category.php?id=SOMECATEGORYID
• Create a HTML Block on the category page
• Insert a image into the HTML Block with the richtext-editor
• Save
• View the category page as logged-in user -> Image appears
• View the category page as not-logged-in user -> Image doesn't appear
• Copy image URL (http://YOURMOODLEURL/pluginfile.php/CONTEXTID/block_html/content/FILENAME.FILESUFFIX) and try to load image in browser -> Login page appears

Hints for solution:
/pluginfile.php fetches context information from given context ID - line 55:
list($context, $course, $cm) = get_context_info_array($contextid);
Unfortunately, $course is null when viewing a block on a category page.

Later, /pluginfile.php calls block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload) in /blocks/html/lib.php.
There, login is required for the given course - line 32:
require_course_login($course);
Unfortunately, as $course is null, login requirement always fails for non-logged-in users and image isn't shown.

A quick and dirty fix would be to replace line 32 in /blocks/html/lib.php

require_course_login($course);

with

if ($course != null)
require_course_login($course);

But I'm quite sure that this would provoke some security issues so I would be grateful if you could provide a better fix