cmc-sales/app/views/attachments/view.ctp

<?php if (file_exists($attachment['Attachment']['file'])) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($attachment['Attachment']['filename']));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($attachment['Attachment']['file']));
    ob_clean();
    flush();
    readfile($attachment['Attachment']['file']);
    exit;
}

?>