EUVD-2026-93657

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106512

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106512

The sachertortephp application contains a vulnerability in the CakeResponse::download() method located in lib/Cake/Network/CakeResponse.php. The root cause is the direct interpolation of unsanitized, caller-supplied filenames into a Content-Disposition header. Two injection vectors exist: using C...