I bet it's a path traversal bug, like you request a listing for files named "../../.." or something.

I love it how they say to update, but there's no point because it won't fix the vulnerability anyway.