"If an XML script is embedded in JavaScript, it is possible to discover the existence of local files, Adobe said in an advisory. "An attacker could then use the information gathered for malicious purposes. However the impact is minimized due to the fact that the existence of local files can only be discovered if the complete filenames and paths are known in advance by the attacker."