The vulnerability arises when the CakeResponse::download() method places a caller‑supplied filename into the Content‑Disposition header without sanitization. Control characters (CR/LF) cause the header to be dropped, allowing the response body to be rendered inline in the browser, while an embedded double quote terminates the quoted string early, letting an attacker inject additional header parameters. These two vectors enable a stored cross‑site scripting (XSS) condition, as malicious HTML or JavaScript can be executed in the victim’s browser on the application origin. The resulting impact includes session hijacking, data exfiltration and the execution of unauthorized actions under the victim’s account.

The issue affects the MISP application component named sachertortephp, a CakePHP‑based MISP application. No specific version range is listed in the CNA data; the vulnerability applies to all releases before the recent sanitization commit.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, so the current explosion probability is unknown, but the lack of a KEV listing does not diminish the risk. The likely attack path requires an authenticated user who can create or upload an attachment or proposal with a crafted filename; the crafted value is stored and later reflected into the HTTP response header when another authenticated user views the associated page, resulting in XSS execution. Given the high CVSS and the nature of the stored payload, the risk to any affected environment is significant until mitigated.