Severity: HIGH
Location: src/Controllers/FileController.php:387
Bug: basename() without stripping CR/LF/quote/backslash allows header injection via crafted original_name.
Fix: Apply the same str_replace guard that download() already uses.
Status: open. Will reply with remediation details when resolved.
Resolved.
FileController::launchEmulator now strips \r, \n, ", \, /, \0 from original_name before interpolating into Content-Disposition (src/Controllers/FileController.php:387). Matches the guard already used in download().
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.