An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) mailto?attach=… parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kmail | Kde | * | 19.12.3 (excluding) |
| Kdepim | Ubuntu | esm-apps/xenial | * |
| Kdepim | Ubuntu | esm-infra-legacy/trusty | * |
| Kdepim | Ubuntu | trusty | * |
| Kdepim | Ubuntu | trusty/esm | * |
| Kdepim | Ubuntu | upstream | * |
| Kdepim | Ubuntu | xenial | * |
| Kmail | Ubuntu | bionic | * |
| Kmail | Ubuntu | eoan | * |
| Kmail | Ubuntu | esm-apps/bionic | * |
| Kmail | Ubuntu | esm-apps/focal | * |
| Kmail | Ubuntu | focal | * |
| Kmail | Ubuntu | groovy | * |
| Kmail | Ubuntu | hirsute | * |
| Kmail | Ubuntu | impish | * |
| Kmail | Ubuntu | kinetic | * |
| Kmail | Ubuntu | lunar | * |
| Kmail | Ubuntu | mantic | * |
| Kmail | Ubuntu | oracular | * |
| Kmail | Ubuntu | upstream | * |