CVE-2026-106512 Details

A vulnerability exists in the CakeResponse::download() method of MISP's sachertortephp library, specifically in versions prior to the recent patch. The issue arises because the method constructs a Content-Disposition header by directly inserting user-supplied filenames into a quoted-string format without proper sanitization. This flaw creates two distinct injection vectors. Firstly, if a filename includes C0 control characters such as carriage return or line feed, PHP will omit the entire Content-Disposition header. As a result, the response body is served with its default Content-Type—such as text/html for .html files—causing the content to render inline in the browser instead of prompting a download. This behavior creates a stored cross-site scripting vulnerability, as the injected script can be executed when the page is viewed. Secondly, if a filename contains a double-quote, it can prematurely terminate the quoted-string value, allowing the injection of additional Content-Disposition parameters. The vulnerability affects all instances where CakeResponse::download() is called, including attribute and proposal downloads, as well as restSearch exports. An authenticated user who can upload or create attachments with manipulated filenames can exploit this issue. Once the malicious filename is stored, any other authenticated user who accesses the relevant page will trigger the execution of the injected content, potentially leading to session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.

The vulnerability has been patched by stripping control characters and double quotes from filenames in the CakeResponse::download() method before the header is composed. This update is included in the latest version of the sachertortephp library.