Apple Maildrop lets you rewrite the filename, size, and icon on any icloud.com attachment link — no signature, no validation — reported July 2023, still live

New public disclosure: MAILDROP-01 Apple's Maildrop attachment service generates icloud.com URLs with three unsigned, client-controlled parameters: - f= — filename shown on the landing page, AND interpolated as ${f} in the CDN download path - sz= — file size shown on the landing page - uk= — user key (no binding between it and the other params) Change f= and sz=, the link. The icloud.com landing page shows your chosen filename, your chosen file size, and the icon Maildrop infers from your chosen extension. The CDN serves the file with Content-Disposition: attachment; filename=" ". Everything on Apple's domain. No visual indicator that the metadata is sender-controlled. Reported 7 July 2023. Status as of 8 April 2026: "Prioritised for review". No remediation deployed. Time elapsed: 34 months. Full technical write-up, Python PoC, and fix recommendations: Vendor ref: OE1950888220 submitted by /u/Prize-Unlucky [link] [ ]