Some folders do not contain indexes, so the list of files contained in this folder may be displayed, which can be a gateway, a potential hacker flaw. To avoid this possibility, you can add this code to htaccess :

Options -Indexes

That is not a flaw of Zenphoto but of the server used which should prohibit this serverside. You should contact your host.

Please avoid topic titles that look like you found a security issue. I have edited the topic title therefore. If you really think you find one you should contact us via mail first.