It was possible for Android Mail application to upload file into directory level higher above configured download folder by crafting the attachment filename in user-assisted scenario. A real impact from this behavior is considered as minimal.