The web server is configured to display directory listings when no index file is present, exposing the file structure and potentially sensitive files to anyone browsing the directory.
Attackers can discover hidden files, backup files, configuration files, or other sensitive resources that were not intended to be publicly accessible.
Disable directory listing in the web server configuration. Add index files to all directories. Review exposed directories for sensitive content. Implement proper access controls on all files.