see folder

@dv1r — short answer: you cannot make plain HTML (or client-side JavaScript) read arbitrary folders on the server or host machine. As @Fungus1487 pointed out, something on the server must enumerate files and produce HTML. If your device only supports CGI (you mentioned it might), you can implement a small CGI script that lists a given folder and serves files for download. @almostbob is right that reusable CGI file managers exist, but a tiny custom script is often easier and safer.

A minimal, safe pattern is:

• pick a single base directory (the only area the script is allowed to show),
• resolve requested paths with realpath and verify they start with the base,
• list directory entries as HTML links (URL-encoded),
• when a file is requested, send proper headers (Content-Type + Content-Disposition) and stream the file in chunks.

Example (Python 3 CGI skeleton — adapt BASE and cgi location):

#!/usr/bin/env python3
import os, sys, html, urllib.parse, mimetypes

BASE = "/path/to/allowed/folder"

qs = os.environ.get("QUERY_STRING", "")
rel = urllib.parse.parse_qs(qs).get("path", [""])[0]
rel = urllib.parse.unquote(rel)
target = os.path.realpath(os.path.join(BASE, rel))

if not target.startswith(os.path.realpath(BASE)):
    print("Status: 403 Forbidden")
    print("Content-Type: text/plain\n")
    print("Forbidden")
    sys.exit(1)

if os.path.isdir(target):
    print("Content-Type: text/html; charset=utf-8\n")
    print("<ul>")
    for name in sorted(os.listdir(target)):
        if name.startswith("."): continue
        href = urllib.parse.quote(os.path.join(rel, name).replace('\\','/'))
        print(f'<li><a href="?path={href}">{html.escape(name)}</a></li>')
    print("</ul>")
else:
    ctype = mimetypes.guess_type(target)[0] or "application/octet-stream"
    print(f"Content-Type: {ctype}")
    print(f'Content-Disposition: attachment; filename=\"{html.escape(os.path.basename(target))}\"\n')
    with open(target, "rb") as fh:
        while True:
            chunk = fh.read(8192)
            if not chunk: break
            sys.stdout.buffer.write(chunk)

Practical setup and safety notes: put the script in your server's cgi-enabled location and chmod +x it; never run as root; restrict BASE to a single folder; skip dotfiles; add authentication (HTTP basic or script-level) before exposing downloads; validate and normalize all inputs to avoid ../ traversal; stream files to avoid memory issues; and consider server-built directory indexes if you just want a quick, read-only view.