The issue allows for an XML External Entity (XXE) attack. This occurs because projects and automations are saved in XML-based files (.xmpp and .xmpa respectively), which are susceptible to XXE injection. By sending a specially crafted .xmpp or .xmpa file to a user, when opened or imported in ModbusPal, it can return the contents of any local files to a remote attacker.