added check for file name

extensions/debug/controllers/DefaultController.php

@@ -97,7 +97,7 @@ class DefaultController extends Controller
 	{
 		$filePath = Yii::getAlias($this->module->panels['mail']->mailPath) . '/' . basename($file);
 
-		if (!is_file($filePath)) {
+		if ((mb_strpos($file, '\\') !== false || mb_strpos($file, '/') !== false) || !is_file($filePath)) {
 			throw new NotFoundHttpException('Mail file not found');
 		}