gcve-1-2026-20153: argument injection in the MISP CakePHP console dispatcher

The source describes insufficient validation of user-supplied data from the MISP event contact form. The person and message fields may be passed to the CakePHP console dispatcher, where reserved path switches may be interpreted as directives rather than data. The fix adds reserved-argument validation and casts the person field to a Boolean. The metadata is a draft and requires human validation.