The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URI using various schemes, which is not properly handled in an error message. The affected schemes include `zip`, `trash`, `tar`, `thumbnail`, `smtps`, `smtp`, `smb`, `remote`, `recentdocuments`, `nntps`, `nntp`, `network`, `mbox`, `ldaps`, `ldap`, `fonts`, `file`, `desktop`, `cgi`, `bookmarks`, or `ar`.