B1LL30

I had the same issue. Mod_Security rule 950006 was catching the ls- in the url call for the file names and was thinking it was a filter command injection. We added a temporary exception to it, and then activated the plugin and it worked.