Profile file disclosure via directory listing

Information disclosure in SourceCodester Best Employee Management System 1.0 allows remote attackers to list profile files via /assets/uploadImage/Profile/. The exposed profile-upload directory is directly reachable over HTTP and returns a directory index instead of denying directory requests, which reveals stored filenames and permits direct retrieval of listed files. No authentication is described as required, but the published record bounds the impact to confidentiality loss from files present in that directory, not write access or code execution.