Code Injection Vulnerability in CakePHP Product by MISP
CVE-2026-106512

8.4HIGH

Key Information:

Vendor

Misp

Status
SachertortePHP
Vendor
CVE Published:
6 October 2026

What is CVE-2026-106512?

The CakeResponse::download() method in CakePHP allows for security vulnerabilities due to improper handling of user-supplied filenames in the Content-Disposition header. Attackers can exploit this by embedding C0 control characters or double quotes in filenames, leading to potential stored cross-site scripting (XSS) vulnerabilities. If an affected file is triggered for download, it could let malicious scripts execute in the context of a user's session, leading to session hijacking, unauthorized data access, and more. The vulnerability affects all implementations of CakeResponse::download(), impacting various functionalities such as file attachments and exports.

Affected Version(s)

sachertortephp 0 <= 1c2da20cbe3f1e2a91458fe9a017823b7273fdac

References

https://github.com/MISP/sachertortephp/commit/afbc551aa6b...
patch
https://github.com/MISP/sachertortephp/commit/e2c80021729...
patch

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Logan Homolka
iglocska
Claude Opus 4.8
Claude Opus 4.8
CCB
Alexandre Dulaunoy
.