CVE-2026-106512

Executive Summary

CVE-2026-106512 is an input-validation flaw (CWE-20) in the CakeResponse::download() method of lib/Cake/Network/CakeResponse.php, where a caller-supplied filename is directly interpolated into a quoted-string Content-Disposition response header without sanitization. The vulnerability affects all callers of CakeResponse::download() — including attribute downloads, proposal downloads, and restSearch exports — and is reachable in deployments such as MISP where authenticated users can name or upload attachments. Impact includes stored cross-site scripting (XSS) via dropped Content-Disposition headers (enabling inline rendering of HTML attachments on the application origin) and response-header manipulation via double-quote injection. No patch, PoC, or public exploit is currently available.

Technical Analysis

The root cause is unsanitized interpolation of a caller-supplied filename into a quoted-string value in a Content-Disposition HTTP response header, constructed by the CakeResponse::download() method in lib/Cake/Network/CakeResponse.php. Because the filename is not sanitized before being embedded inside the quoted-string, the resulting header bytes are fully attacker-influenced. The NVD description documents two distinct injection vectors:

1. C0 control character injection (CR/LF). If the filename contains C0 control characters — specifically carriage return (CR) or line feed (LF) — PHP will refuse to emit the entire Content-Disposition header. The header is silently dropped. As a consequence, the attachment disposition is lost, and the response body is served with its own Content-Type (for example, text/html for an .html attachment). The browser then renders that body inline on the application origin, producing a stored cross-site scripting (XSS) condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled — meaning a victim only needs to view a page that triggers the download for the payload to render in the victim's browser within the trusted origin's context.

2. Double-quote injection. A double-quote character (") in the filename terminates the quoted-string value early. This permits injection of additional Content-Disposition parameters into the header value, i.e., header manipulation. Depending on the parameters supplied, this can alter how the response is handled downstream (disposition, filename semantics, or other header parameters).

The attack surface is broad because CakeResponse::download() is a shared helper. Per the NVD description, the affected code path covers all callers of CakeResponse::download(), explicitly including attribute downloads, proposal downloads, and restSearch exports. The user-controlled input to the vulnerable method is the filename associated with an attachment or export. Any authenticated user who can create or upload an attachment with a crafted filename — for example through MISP attribute naming or proposal attachment naming — can store the malicious filename. When another authenticated user subsequently views the affected page (triggering the download/export), the unsanitized filename is reflected into the HTTP response header, resulting in the described header manipulation and/or dropped-header XSS condition.

There is no evidence of authorization bypass at the header-construction step: the flaw is a classic missing output/encoding sanitization of data flowing into an HTTP header. The primary trust boundary crossed is between the attacker-controlled stored filename and the victim's browser interpretation of the response (disposition vs. inline rendering) and the HTTP header structure itself. No CVSS vector or score was published by the CNA or NVD, and no EPSS score has been assigned by FIRST.org.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the vector details documented in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an Internet- or intranet-exposed deployment that uses the affected CakeResponse::download() implementation (e.g., MISP instances exposing attribute downloads, proposal downloads, or restSearch exports). Fingerprinting can rely on the application's login/landing pages (see Shodan dorks) and the presence of download/export endpoints reachable after authentication.

2. Triggering the flaw class. The attacker needs the ability to store a crafted filename that will later be passed to CakeResponse::download(). Per the description, this can be achieved through attachment naming/upload paths such as MISP attribute naming or proposal attachment naming. Two payload shapes are possible at the vulnerability-class level:

   • A filename containing CR/LF characters, to cause PHP to refuse to emit the Content-Disposition header.
   • A filename containing a double-quote ("), to terminate the quoted-string early and inject additional Content-Disposition parameters.

3. Execution / delivery method. The stored filename is persisted. The victim, who is any other authenticated user, merely views a page that triggers the download/export (the description notes this is reachable even with download_attachments_on_load enabled). At that point, the unsanitized filename is reflected into the HTTP response header. For the CR/LF vector, the missing Content-Disposition causes the response body to be served with its own Content-Type (for example text/html), and the browser renders it inline on the application origin — executing stored script in the victim's authenticated session context. For the double-quote vector, additional header parameters are injected, manipulating the response header.

4. Post-exploitation impact. Successful inline rendering of attacker-controlled text/html on the trusted origin yields stored XSS: session/token theft, actions performed as the victim, and access to data returned to the victim's page are all in scope for the script payload. The double-quote/header-manipulation vector alters response header semantics, which can be leveraged to influence how the response is treated by browsers or intermediary components. No privilege escalation beyond the victim's own authenticated context, no RCE, and no authentication bypass are documented.

Note: No public PoC or exploit code is available for CVE-2026-106512. The above is derived from the documented flaw class and vectors only; no function names, endpoints, or parameters beyond those in the NVD description are asserted.

Impact Assessment

Business impact. Because the XSS condition occurs on the application origin and is triggered when another authenticated user views the affected page, the trust of the platform is undermined. In a threat-intelligence sharing platform context (e.g., MISP), a compromised user session could expose sensitive shared intelligence, allow tampering with shared data, or facilitate lateral phishing within the trusted platform — making this a high-value target for attackers seeking intelligence collection rather than mere defacement.

Affected systems / blast radius. All callers of CakeResponse::download() are in scope, including attribute downloads, proposal downloads, and restSearch exports. The input (filename) is stored attacker-controlled data, so the blast radius is a function of (a) how many users can create/name attachments and (b) how many users view/trigger those attachments — typically the entire authenticated user base.

CVSS subscores. No CVSS score or vector was published by the CNA or NVD. A representative vector consistent with the documented mechanism is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N — network vector, low complexity, low privileges required (authenticated attachment naming), user interaction required (victim views the page), scope changed (browser crosses into trusted origin rendering), with limited confidentiality and integrity impact and no availability impact. CVSS is presented as illustrative and is not an official score.

Exploit likelihood. No public exploit or PoC is available and no EPSS score has been assigned. The barrier is low for an authenticated user but the flaw is not pre-authentication, and exploitation depends on a second user viewing the affected page. CISA KEV status: NO.

Detection Guidance

Sigma Rule

title: CakeResponse::download() Content-Disposition Filename Injection (CVE-2026-106512)
id: 7b2c9e4a-1f3d-4a8e-9c21-1065120001
status: experimental
description: Detects HTTP responses where the Content-Disposition header is missing for download/export endpoints, consistent with CR/LF filename injection, or where the header carries injected parameters (double-quote vector).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106512
author: valtersit.com
date: 2026/06/01
tags:
  - attack.t1190
  - cwe.cwe-20
logsource:
  product: webserver
  category: proxy
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/attributes/download'
      - '/proposals/download'
      - '/restSearch'
      - '/rest'
  selection_disposition_absent:
    cs-method: 'GET'
    sc-status: 200
  filter_normal_disposition:
    cs-header|contains: 'Content-Disposition: attachment'
  condition: selection_endpoint and selection_disposition_absent and not filter_normal_disposition
falsepositives:
  - Legitimate downloads served by non-CakePHP components using alternative disposition handling
level: medium

YARA Rule

rule EXPL_CVE_2026_106512_ContentDisposition_Filename_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects Content-Disposition header construction patterns indicative of filename interpolation in CakeResponse::download()"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106512"
        date = "2026-06-01"
        severity = "medium"

    strings:
        $cd1 = "Content-Disposition" ascii nocase
        $dl1 = "CakeResponse" ascii nocase
        $dl2 = "download(" ascii nocase
        $cdp = "attachment; filename=" ascii nocase
        $ctl = { 0D }  // carriage return
        $q   = "\"" ascii

    condition:
        ($cd1 and $cdp and $dl1) or
        ($cd1 and $dl1 and $ctl) or
        ($cdp and $dl2 and $q)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106512 Content-Disposition filename injection attempt (CR/LF or quote)"; flow:established,to_server; http.uri; content:"download"; http.uri; content:"filename="; http.header; pcre:"/filename=[^\r\n]*[\x0d\x0a\"]/i"; reference:cve,CVE-2026-106512; classtype:web-application-attack; sid:10651201; rev:1;)

Elastic Detection

sequence by user.name
  [ process where event.category == "web" and process.command_line : "*download*" ]
  [ network where network.protocol == "http" and http.response.status_code == 200 and
    not http.response.headers.content_disposition : "attachment*" ]

Splunk SPL Query

index=web
| eval cd_present=if(isnull(content_disposition) OR match(content_disposition, "attachment"), 1, 0)
| where match(uri, "download|restSearch|attribute|proposal") AND method="GET" AND status=200 AND cd_present=0
| stats count by src_ip, uri, status, content_disposition
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-106512,">
  <rule id="106512" level="10">
    <decoded_as>json</decoded_as>
    <match>Content-Disposition</match>
    <regex>filename=.*[\x0d\x0a"]</regex>
    <description>CVE-2026-106512: Content-Disposition filename injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>

  <rule id="106513" level="8">
    <decoded_as>json</decoded_as>
    <match>download</match>
    <regex>status.*200</regex>
    <description>CVE-2026-106512: Possible XSS via dropped Content-Disposition on download endpoint</description>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch reference, or patched version has been identified from any tracked source; no affected-version list was returned.

1) Immediate mitigations.

• Sanitize filenames on input and at output. Given the flaw is unsanitized interpolation, the most direct mitigation is to strip/reject CR, LF, and double-quote (") characters from any filename accepted during attachment creation/naming (attribute naming, proposal attachment naming) and to sanitize again before the filename is passed into CakeResponse::download().
• Hard-force the response body disposition. Ensure download responses are always served with a safe, static Content-Disposition: attachment and a strict Content-Type (e.g. application/octet-stream) that does not inherit attacker-controllable attachment MIME types, so a dropped disposition header cannot lead to inline text/html rendering.
• Do not rely on the download_attachments_on_load setting for safety. The description explicitly notes the XSS vector is reachable even when this setting is enabled.
• Add a defenses-in-depth CSP and X-Content-Type-Options: nosniff on the application origin to reduce inline-render/XSS blowback while a patch is pending.
• Restrict who can create/name attachments where operationally feasible, and review stored filenames for CR/LF/" to identify pre-planted payloads.

2) Patch / upgrade steps. No patch is currently available from the vendor. Track the upstream CakePHP CakeResponse component and the consuming application (e.g., MISP) for a fix, and apply it through the normal release/upgrade path as soon as one is published. Until then, treat any instance exposing the affected download/export endpoints as vulnerable.

3) Long-term hardening.

• Encode/sanitize all values inserted into HTTP response headers at the framework level (never interpolate raw user data into quoted-string header values).
• Enforce a repository-wide policy that attachment/download filenames are validated against a strict allowlist before persistence and before header construction.
• Add regression tests covering CR/LF, quote, and control-character filenames passed to download/export paths.
• Monitor download/export endpoints for missing Content-Disposition headers and for response-type anomalies as a detection backstop.

References

• NVD — CVE-2026-106512: https://nvd.nist.gov/vuln/detail/CVE-2026-106512
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CakePHP project (upstream CakeResponse component) — monitor advisories for a patch: https://github.com/cakephp/cakephp
• MISP project (consuming application referenced by the callers) — monitor advisories/releases: https://github.com/MISP/MISP

No public PoC or exploit code is available for CVE-2026-106512. No known threat actor campaigns or exploit-in-the-wild evidence are documented at this time; the vulnerability is not listed in CISA KEV and has not been scored by FIRST.org EPSS.