I'm setting up a simple system that is using an HTTP server which is writing incoming data to JSON files in a specific directory. This is functioning as a very simple pseudo-database. For simplicity, assume Java and no direct exploits on the server software itself - users can send JSON, it is written to a specific file, and they can request the contents of all those files.
Am I missing a major security issue here? Can the users somehow abuse this design to get access in any way?
If you would call this a database, my fear is an attack vector similar to SQL injection.
If the OS is important (which I guess it would be), a focus on Windows and Linux/Unix would be nice.