[xab9]

Isn't this a click-baitish title? I would say that this is a configuration issue and not "exactly" a vulnerability and basically get off my lawn.

Reading blueimp's and larry's comments here I envy their constructivity, open mindedness and professionalism.

[blueimp]

Thanks! Comments like yours are what keeps me motivated to continue contributing to open source software.

But although the title is somewhat click-bait, I still think this counts as a vulnerability in my project, since there is a possible combination of default Apache setting and default project files that is exploitable.