Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_fo…
低危 CVSS 3.7
摘要
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://cna.erlef.org/cves/CVE-2026-48598.html Third Party Advisory
- https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e Patch
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-48598 Third Party Advisory
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 Vendor Advisory
时间线
- nvd_ingest NVD