Reflected File Download (RFD)

ktor-http is vulnerable to reflected file download attacks. The vulnerability exists because the Content-Disposition filename parameter is not properly encoded which allows an attacker to perform untrusted file downloads.