Summary

An attacker can gain additional information about the server by checking if certain directories exist.

PoC

First, UserJS or UserCSS needs to be enabled and have submitted contents so that we can have an existing file to refer to.

Then navigate to an URL like https://192.168.91.132:8080/ext.php?f=../../../../etc/apache2/../../var/www/FreshRSS/data/users/[your_username]/extensions/UserJS/script.js&t=js to see if the /etc/apache2 directory exists on the server (you have to know the full path of the FreshRSS installation directory).

You can also enumerate users without knowing the installation path:
https://192.168.91.132:8080/ext.php?f=[some_user]/../[your_username]/extensions/UserJS/script.js&t=js&t=js

If you get a "File is not supported." error, this means the directory does not exist, if you get the contents of your UserJS, this means the directory exists.

Impact

An attacker can check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server.