The format for the link for an attachment is:
Where KINETICSERVER, SPACESLUG, SUBMISSIONID, FIELDNAME, FILEINDEX, and FILENAME are replace with the appropriate values for the attachment in question. So to display an image the user has upload in the submission back to them, it could be:
The original permissions for the submission are applied. This could be problematic when, for example, you want to make an attachment accessible from one task to the next in a workflow. For this, it might be better to use the copy attachment handler to actually copy the attachment into the new item and make it read-only.