Agree, it's a serious vulnerability, but it's not exploitable remotely.