JavaMail is vulnerable to a directory-traversal attack where files can be written to an arbitrary location within the filesystem, by specifying a Content-Disposition header which contains a relative path.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/37193/javamail_dir_travers.txt
Source: https://packetstormsecurity.com/files/37193/javamail_dir_travers.txt.html