Mailto: ?attach=~/ parameter allows including arbitrary files on disk
I&#x27;m not convinced this is as big an issue as has been made out here.<p>Why would you click a link and then voluntarily send an email with a file called &quot;passwd&quot; or &quot;secring.gpg&quot; in the attachments list?!<p>Perhaps you could show a scarier warning or something, rather than just declaring the functionality unacceptably dangerous and removing it. There are genuine use-cases discussed in this thread. At the end of the day, the user needs to accept responsibility for things they voluntarily do on their machine.<p>Generally though, I&#x27;m not sure this functionality makes much sense if it&#x27;s initiated from a web-page. If you had another app on your machine though, that already had disk access, it might make sense to be able to launch the email client with something pre-attached.