CVE-2026-106512: CWE-113 HTTP Response Splitting in MISP sachertortephp

The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php of MISP sachertortephp constructs the Content-Disposition header by directly interpolating a caller-supplied filename without sanitization. Two injection vectors exist: (1) inclusion of C0 control characters (CR or LF) causes PHP to drop the Content-Disposition header, resulting in the response body being rendered inline and enabling stored XSS; (2) a double-quote character prematurely terminates the quoted-string, allowing injection of additional header parameters. This affects all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user can upload a crafted filename to trigger this vulnerability, which is exploitable when other authenticated users view the affected pages.

This vulnerability allows an authenticated attacker to store malicious filenames that lead to HTTP response splitting and stored cross-site scripting attacks when viewed by other authenticated users. The impact includes session hijacking, data exfiltration, and unauthorized actions performed on behalf of victims. The CVSS 4.0 score is 8.4 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability of authenticated users to upload or create attachments with untrusted filenames containing control or special characters. Implement input validation or sanitization on filenames before they are used in HTTP headers to prevent injection.