An arbitrary file read issue exists in the handling of attributes within outgoing email HTML. Attackers capable of supplying outgoing email content can set an attribute value that references a local file path, allowing them to expose sensitive files from the server.