"Ideally, you wouldn't allow the entire private file system, though you can. It would be better if the files for attaching were in a subdirectory and you allowed that subdirectory."
Correct, this is what I'm planning to do.
But problem is that I cant get the Attachment on the mail, and already tried with all the possible paths, relative absolute etc.
hrdesign.web → created an issue.