MISP sachertortephp: Stored XSS via unsanitized download filename
Summary
The CakeResponse::download() method in sachertortephp, the CakePHP-based application of MISP, builds the Content-Disposition header from a caller-supplied filename without sanitization. An authenticated user who can create or upload an attachment with a crafted filename, for example in MISP attribute or proposal naming, can store a malicious name. When another user views the affected page, control characters can suppress the attachment disposition so that HTML is rendered inline on the application origin, and double quotes can inject extra header parameters. The impact is equivalent to stored cross-site scripting, including session hijacking and unauthorized actions.
Affected
- MISP sachertortephp, versions 0 to the commit 1c2da20cbe3f1e2a91458fe9a017823b7273fdac (no release version given)
- Affected function: CakeResponse::download() in lib/Cake/Network/CakeResponse.php and all its callers, including attribute downloads, proposal downloads and restSearch exports
Fixed in
- Unknown. No fixed release version was found.
- Two commits are referenced as security fixes: afbc551aa6b8aedb87dfa1223a388e9a3178abfd (strips C0 control characters and DEL) and e2c80021729611922817a57d2317b2ffa7ed1439 (escapes double quotes and backslashes).
- Sources conflict: one source lists fix availability as not reported.
Workaround
- No vendor workaround found.
- Restrict who can create or upload attachments and set attribute or proposal names.
- Review existing attachment filenames for quotes and control characters.
- Optionally, send X-Content-Type-Options: nosniff and a restrictive Content-Security-Policy from a reverse proxy. This limits impact but is not a fix.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV; CISA SSVC lists exploitation as none and automatable as no.
- EPSS below 1%.
- No public proof of concept found.
Our recommendation
- Confirm whether your MISP installation includes sachertortephp and which commit it runs.
- Review the two referenced commits and apply them, or upgrade once a fixed release is published.
- Audit accounts that can upload attachments and remove unneeded access.
- Prioritise internet-exposed instances and instances with many accounts or cross-organisation sharing.
- Monitor NVD and the MISP project for an advisory or release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit: strip control characters from download filenames github.com
- Fix commit: escape the download filename quoted-string github.com
- OSV entry CVE-2026-106512 osv.dev
- OpenCVE CVE-2026-106512 app.opencve.io
- threatint CVE-2026-106512 cve.threatint.com
- Hol.org CVE-2026-106512 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:46.
Original description (NVD)
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.