# CVE-2026-106512: CakePHP CakeResponse download method header injection and XSS

Source: https://junglewise.ai/threats/cve-2026-106512-the-cakeresponse-download-method-in-lib-cake-network  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106512 · Severity: info · Published 2026-10-06

CakePHP's file download functionality constructs HTTP headers using unsanitized user-supplied filenames. An authenticated attacker can create attachments with malicious filenames that, when viewed by other users, inject arbitrary HTML or JavaScript into the browser, potentially stealing sessions, exfiltrating data, or performing unauthorized actions. The vulnerability affects attribute downloads, proposals, and search exports across the platform.

Technologies: [Cakephp](https://junglewise.ai/threats/technologies/cakephp). Vendors: [Cakephp](https://junglewise.ai/threats/vendors/cakephp).

## Quick answers

**Is CVE-2026-106512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106512 being exploited in the wild.

**How severe is CVE-2026-106512?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Cakephp Versions prior to fix for CVE-2026-106512.

**Is there a fix for CVE-2026-106512?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-106512 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106512?** Check whether you run Cakephp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php directly interpolates user-supplied filenames into the Content-Disposition header without sanitization. Two attack vectors exist: CR/LF characters cause PHP to drop the header entirely, serving the response body with its original Content-Type inline in the browser (stored XSS), and double-quotes terminate the quoted-string prematurely, allowing injection of additional Content-Disposition parameters. The vulnerability requires authentication to upload a crafted filename and affects any other authenticated user viewing the page with the malicious attachment.

## Affected products

- CakePHP CakePHP Versions prior to fix for CVE-2026-106512

## Timeline

- 2026-10-06: disclosed

## Related threats

- [CakePHP SQL injection in collation handling](https://junglewise.ai/threats/cve-2026-119419-cakephp-through-5-4-3-contains-an-sql-injection-vulnerability)
- [CakePHP SQL injection in WindowExpression](https://junglewise.ai/threats/cve-2026-119418-cakephp-through-5-4-3-contains-an-sql-injection-vulnerability)
- [CakePHP improper cookie domain validation in Http Client](https://junglewise.ai/threats/cve-2026-119416-cakephp-through-5-4-3-contains-an-improper-cookie-domain)
- [CakePHP FunctionsBuilder SQL injection in multiple methods](https://junglewise.ai/threats/cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods)
- [CakePHP FunctionsBuilder::jsonValue SQL injection with PostgresDriver](https://junglewise.ai/threats/cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with)