CVE-2023-38546: cookie injection with none file