CVE-2026-106512

Name of the Vulnerable Software and Affected Versions CakePHP (affected versions not specified)

Description The CakeResponse::download() function in lib/Cake/Network/CakeResponse.php fails to sanitize caller-supplied filenames when constructing the Content-Disposition header. This leads to two injection vectors: the use of C0 control characters (CR or LF) can cause PHP to drop the Content-Disposition header, resulting in the response body rendering inline in the browser, and the use of double-quote characters can terminate the quoted-string value early to inject additional header parameters. An authenticated user can upload an attachment with a crafted filename that, when viewed by another authenticated user, allows for header manipulation and the execution of arbitrary HTML or JavaScript. This condition enables stored cross-site scripting, which can lead to session hijacking, data exfiltration, and unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.