{"api_version":"v1","generated_at":"2026-10-08T22:05:00+00:00","product":{"cve_count":1,"evidence_gap_note":"This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.","id":"security:cve-misp-sachertortephp-323da16cd699","lifecycle_state":"evidence_gap","linked_lifecycle_url":null,"name":"sachertortephp","next_cursor":null,"observations":[{"affected":"sachertortephp: \u2264 1c2da20cbe3f1e2a91458fe9a017823b7273fdac","affected_versions_present":true,"cve_id":"CVE-2026-106512","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-106512","fixed":"The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content.","last_modified":"2026-10-07T16:31:28.513Z","patch_url":"https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd","primary_source":"","published":"2026-10-06T18:48:29.598Z"},{"affected":"sachertortephp: < 1c2da20cbe3f1e2a91458fe9a017823b7273fdac","affected_versions_present":true,"cve_id":"CVE-2026-92932","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-92932","fixed":"The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options['readFile'] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller's intended control over remote reads and eliminating the SSRF vector.","last_modified":"2026-09-17T18:30:42.720Z","patch_url":"https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac","primary_source":"","published":"2026-09-17T12:33:44.852Z"}],"source_generated_at":"2026-10-08T06:18:52.353Z","vendor":"MISP"}}