Content-Disposition gives presentation information for a MIME body part. Common dispositions are inline and attachment.
An attachment can also include a filename parameter.
Do not use Content-Disposition alone as a security verdict. Malicious messages can use misleading filenames, mismatched media types or unusual MIME structures. Security tooling should parse the actual message and content.