Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_fo…
Low CVSS 3.7
Summary
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-48598.html Third Party Advisory
- https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e Patch
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-48598 Third Party Advisory
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 Vendor Advisory
Timeline
- nvd_ingest NVD