Geary’s mailto URI handling incorrectly processes a non‑standard `attach` When a user clicks a link such as `mailto:user@example.com?attach=/path/to/sensitive_file`, the client opens a compose window and silently attaches the local file, exposing the file’s contents to whoever receives the email. The flaw therefore allows accidental disclosure of sensitive local data without any visual warning.

The vulnerability is present in the GNOME Geary email client. No specific version information is provided, so all releases containing the current mailto parser are potentially affected until a fix is issued. Users should check their package repositories for an updated Geary release once the issue is resolved.

The CVSS score of 6.5 indicates moderate severity. It is inferred that the attacker must persuade a user to click a crafted link, which is a social engineering step; no additional privileges or remote code execution are required. EPSS data is not available and the vulnerability is not listed in CISA KEV. Nevertheless, it is inferred that the ability to transfer any local file without the user’s knowledge can lead to significant data exposure, making the risk non‑negligible.