> Source: [sk184810](https://support.checkpoint.com/results/sk/sk184810)

# sk184810 - Threat Extraction changes downloaded PDF filename to a numeric value

| Property | Value |
|----------|-------|
| Solution ID | sk184810 |
| Date Created | 2026-07-06 |
| Last Modified | 2026-07-09 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20 |
| OS | Gaia |

## Symptoms

- * When users download some PDF files, the saved filename changes to a numeric ID such as *1764162082523.cleaned.pdf* or *1764162082523.pdf* instead of the expected descriptive filename.
* This behavior occurs only when both Threat Extraction and HTTPS Inspection are applied to the traffic.
* Threat Extraction logs show that the PDF is sanitized and downloaded with the numeric filename.
* If Threat Extraction is not applied to the traffic, or if HTTPS Inspection is not applied to the traffic, the browser can save the file with the descriptive filename that the web application presents to the user.

## Cause

Some web applications show a friendly filename in the browser, but the actual file download response does not include a Content-Disposition header with that filename. In supported versions, Threat Extraction can inspect files downloaded over HTTP and HTTPS, and HTTPS Inspection decrypts the HTTPS session so the enabled Software Blades can inspect the response.  

In this case, when the gateway processes the PDF response and does not receive a usable filename in Content-Disposition, it uses other available HTTP information to determine the filename. The only stable value available in the inspected traffic is the numeric document ID in the URL path. As a result, the sanitized file is delivered with a numeric name such as *\<numeric\>.pdf* or *\<numeric\>.cleaned.pdf* , instead of the descriptive name shown by the web application in the browser.  

When Threat Extraction or HTTPS Inspection is not applied to the traffic, the browser receives the file without gateway processing and can use the web application's own filename logic to save the file with the expected descriptive name.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content