Severity: MEDIUM
Location: src/Controllers/MessageController.php:444-447
Bug: text/plain in inline MIME list; crafted file may render as HTML in some configs.
Fix: Drop text/plain from inline MIMEs; force download.
Status: open. Will reply with remediation details when resolved.
Resolved.
Dropped text/plain from the inline-MIME list in MessageController::downloadAttachment (src/Controllers/MessageController.php). Message attachments reported as text/plain by finfo are now served with Content-Disposition: attachment, forcing download. Prevents crafted text files containing HTML from being rendered inline in configurations that still MIME-sniff.
Image MIMEs (image/jpeg, image/png, image/gif, image/webp) remain inline.
Locking this thread.