What's the vulnerability here ? You are just listing the files , you can't actually read the php files as they are executed on the browser , and most of the files are php so what's the impact here ?