An attacker could obtain source code on the server-side of the web application, that may contain highly sensitive data – such as database connection, credentials – along with the logic behind the code and the business logic of the application.
An attacker may use this vulnerability to collect sensitive information about the system. An attacker can use this information to conduct further attacks.
To prevent this finding, implement access control and access to non-public files, ensure that no code is left in the comments. if possible is better to remove these files.
Also, ensure that no code is left in the comments.
By obtaining the source code the attacker can have a deeper knowledge of the logic behind the Web application, how the application handles requests and their parameters, vulnerabilities in the code, and source code comments.