Looks like they need access to the system first, but I have to doubt a lot of orgs block notepad, so definitely a good vulnerability