The element below is an ordinary text element, not a file element, otherwise this wouldn't be a vulnerability.
Back to the advisory.