There is a security problem with shtml.exe that allows anyone to explore the local path of IIS web server.