CVE-2026-106512 in SachertortePHP
Summary
by MITRE • 10/07/2026
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability resides within the CakeResponse::download() method located in lib/Cake/Network/CakeResponse.php, where the construction of the Content-Disposition header exhibits critical input validation flaws. The core technical issue stems from the direct interpolation of caller-supplied filename data into a quoted-string value without adequate sanitization or encoding. This design oversight creates two distinct injection vectors that compromise the integrity and security of HTTP responses generated by the application. The first vector involves C0 control characters, specifically carriage return (CR) and line feed (LF). When such characters are present in the supplied filename, PHP refuses to emit the entire Content-Disposition header due to strict parsing rules regarding headers containing invalid characters. Consequently, the attachment disposition is silently dropped from the response. In this scenario, the server continues to serve the response body with its original Content-Type header intact. For instance, if an attacker uploads a file named index.html.php or similar that triggers text/html content type serving, and the filename contains newlines causing the header drop, the browser will render the content inline rather than as a download attachment. This behavior effectively transforms what should be a secure file transfer into a stored cross-site scripting (XSS) condition because malicious scripts embedded in the served content are executed within the context of the application origin.
The second injection vector exploits the lack of proper escaping for double-quote characters within the filename string. Since the filename is placed inside a quoted-string value in the Content-Disposition header, an attacker can inject a closing double quote to terminate the intended parameter early. This allows the subsequent content to be interpreted as additional parameters or values within the same HTTP header line. While this specific vector primarily facilitates header manipulation by injecting arbitrary key-value pairs into the response headers, it fundamentally breaks the assumption that user input is safely contained. The combination of these two vectors means that an attacker can control how the browser interprets the response, either by forcing inline execution of content via C0 character injection or by manipulating HTTP headers to potentially alter caching behavior, security policies, or other header-dependent functionalities through double-quote termination.
The operational impact of this vulnerability is severe and equivalent to a stored cross-site scripting attack. The affected code path encompasses all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports within the MISP platform context. An authenticated user with permissions to create or upload attachments can store a crafted filename containing either C0 control characters or double quotes. When another authenticated user views a page that triggers this download—such as viewing an incident detail page where such files are listed—the unsanitized filename is reflected directly into the HTTP response headers sent back to the victim's browser. Because modern browsers enforce strict same-origin policies, any script executed in this context runs with full privileges of the application origin. This enables session hijacking through cookie theft, data exfiltration by sending sensitive information to an attacker-controlled server, and unauthorized actions performed on behalf of the victim user. The vulnerability is particularly dangerous because it can be triggered even when settings like download_attachments_on_load are enabled, requiring only that a victim views a page containing the malicious link or reference.
From a classification perspective, this flaw aligns with CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) and CWE-16: Configuration. The ability to manipulate HTTP headers via injection also touches upon CWE-20: Improper Input Validation. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through phishing or lure mechanisms if combined with social engineering, but more directly it enables Execution by allowing arbitrary script execution in the victim's browser context. It can be categorized under T1059: Command and Scripting Interpreter for client-side scripting languages like JavaScript. The persistence aspect is covered as Stored XSS allows the malicious payload to remain active until the filename or attachment is removed, affecting multiple victims over time without further interaction from the attacker beyond initial upload.
Mitigation strategies must address both input validation at the point of entry and output encoding at the point of reflection. First, application code should strictly validate filenames against a whitelist of allowed characters, rejecting any input containing C0 control characters (ASCII 0-31) or double quotes before they are stored in the database or file system. Second, when constructing HTTP headers, developers must ensure that user-supplied data is properly encoded to prevent header injection. Specifically for Content-Disposition headers, filenames should be either URL-encoded if using RFC 5987 format (filename*=UTF-8'...'value) or strictly sanitized to remove any characters that could break the quoted-string syntax in standard HTTP/1.1 responses. Upgrading to a patched version of the framework is the primary remediation step. Additionally, implementing Content-Security-Policy headers with strict directives can mitigate the impact of successful XSS attempts by restricting script execution sources and preventing inline scripts from running even if they are injected into the DOM or response body. Regular security audits focusing on HTTP header construction in web frameworks are essential to prevent similar reflection-based injection flaws in other parts of the application logic.