[stevekemp]

Now that it has been fixed I'll say the site previous allowed you to enter URLs of the form `file:///etc/passwd`, which were then rendered in the PDF output.

In short arbitrary local file inclusion.