{"id":"CVE-2026-48598","aliases":["EEF-CVE-2026-48598","EUVD-2026-34012","GHSA-28jh-g32x-v9v4"],"status":"published","title":"CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection","description":"Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00273,"percentile":0.19872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-116"],"published":"2026-06-02T19:08:19Z","modified":"2026-10-28T02:30:45Z","exploits":[{"source":"pocgithub","id":"workshops-de/google_gax","title":"workshops-de/google_gax","date":"2026-06-09","url":"https://github.com/workshops-de/google_gax"}],"fixes":[{"ecosystem":"Hex","package":"tesla","fixed_in":["1.18.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"tesla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"1.18.3"}]}]},{"source":"osv","ecosystem":"Hex","package":"tesla","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"1.18.3"}]}],"versions":["0.10.0","0.8.0","0.9.0","1.0.0","1.0.0-beta.1","1.1.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0"]},{"source":"osv","ecosystem":"Hex","package":"tesla","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"1.18.3"}]}],"versions":["0.10.0","0.8.0","0.9.0","1.0.0","1.0.0-beta.1","1.1.0","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.17.0","1.18.0","1.18.1","1.18.2","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0"]}],"products":[{"vendor":"elixir-tesla","product":"tesla"},{"vendor":"nvidia","product":"tesla"}],"references":[{"url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4","tags":["vendor-advisory","related","exploit","Vendor Advisory","advisory","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-48598.html","tags":["related","Mitigation","Third Party Advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-48598","tags":["related","Third Party Advisory","web"]},{"url":"https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351","tags":["related","fix","web"]},{"url":"https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48598","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-28jh-g32x-v9v4"},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48598.json","tags":["advisory"]},{"url":"https://github.com/elixir-tesla/tesla","tags":["package"]},{"url":"https://hex.pm/packages/tesla","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48598","title":"CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection","description":"Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.","status":"published","published":"2026-06-02T19:08:19.921Z","modified":"2026-09-24T21:00:20.385Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-34012","description":"Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.","status":"published","published":"2026-06-02T19:08:19Z","modified":"2026-09-24T21:00:20Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"ghsa":[{"id":"GHSA-28jh-g32x-v9v4","title":"Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values","description":"### Summary\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition parameter can use unescaped double-quotes to inject extra disposition key-value pairs, or CRLF sequences to inject additional part headers or prepend bytes to the part body.\n\n### Details\n\n`part_headers_for_disposition/1` in `lib/tesla/multipart.ex` formats each disposition parameter as `k=\"v\"` with no sanitization. Values flow in from `add_field/4` (the `name` argument), `add_file/3` and `add_file_content/4` (the `filename` argument and any disposition opts). A `\"` in the value closes the quoted parameter early, allowing extra `; key=\"value\"` pairs to be appended. A `\\r\\n` ends the `Content-Disposition` header line entirely, with subsequent bytes interpreted as additional part headers (e.g. a forged `Content-Type`); a second `\\r\\n` ends the whole part header block and prepends attacker bytes to the part body.\n\nThe default-filename path in `add_file/3` derives the name via `Path.basename/1`, which does not strip CR or LF, so any code that forwards a partially attacker-controlled file path is equally vulnerable.\n\n### PoC\n\n1. Call `Tesla.Multipart.add_file_content/4` with a filename containing `\\r\\nX-Injected: evil`.\n2. POST the multipart body to any upstream via any Tesla adapter.\n3. The upstream receives `X-Injected: evil` as a standalone header line on the affected part.\n\n### Impact\n\nLow severity (CVSS v4.0: 2.1). Any application using `tesla` 0.8.0 through 1.18.2 that passes untrusted input into `add_field/4`, `add_file/3`, or `add_file_content/4` disposition parameters is affected. Consequences range from forging part-level headers to body prepending against lenient multipart parsers. Fixed in tesla 1.18.3.\n\n### Workarounds\n\nValidate disposition parameter values before passing them to the multipart API, rejecting any value that contains `\\r`, `\\n`, or `\"`.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","status":"published","published":"2026-07-10T00:04:37Z","modified":"2026-07-10T00:04:38Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:40:42.703776Z"}],"nvd":[{"id":"CVE-2026-48598","description":"Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.","status":"published","published":"2026-06-02T20:16:38.847Z","modified":"2026-09-24T21:17:13.76Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-48598","title":"CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection","description":"Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.","status":"published","published":"2026-06-02T19:08:19.921Z","modified":"2026-10-28T02:30:45.117136311Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"EEF-CVE-2026-48598","title":"CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection","description":"## Summary\n\nImproper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped `Content-Disposition` parameter values.\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates each disposition parameter as `#{k}=\"#{v}\"` with no validation of CR (`\\r`), LF (`\\n`), or double-quote characters. The values come verbatim from the caller via `Tesla.Multipart.add_field/4` (the `name` parameter), `Tesla.Multipart.add_file/3`, and `Tesla.Multipart.add_file_content/4` (both the `filename` parameter and other disposition opts). A `\"` in the value closes the quoted parameter early; a `\\r\\n` ends the `Content-Disposition` header line and starts a new part header (such as a forged `Content-Type`), or, after a second `\\r\\n`, ends the entire part header block and prepends bytes to the part body. The default-filename path in `add_file/3` derives the filename via `Path.basename/1`, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.\n\n## Workarounds\n\nValidate disposition parameter values before passing them to `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`, rejecting any value that contains `\\r`, `\\n`, or `\"`.\n\n## Configurations\n\nThe application must pass untrusted input into a disposition parameter of `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`.","status":"published","published":"2026-06-02T19:08:19.921Z","modified":"2026-09-24T21:15:02.896785631Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:33.047032Z"},{"id":"GHSA-28jh-g32x-v9v4","title":"Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values","description":"### Summary\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition parameter can use unescaped double-quotes to inject extra disposition key-value pairs, or CRLF sequences to inject additional part headers or prepend bytes to the part body.\n\n### Details\n\n`part_headers_for_disposition/1` in `lib/tesla/multipart.ex` formats each disposition parameter as `k=\"v\"` with no sanitization. Values flow in from `add_field/4` (the `name` argument), `add_file/3` and `add_file_content/4` (the `filename` argument and any disposition opts). A `\"` in the value closes the quoted parameter early, allowing extra `; key=\"value\"` pairs to be appended. A `\\r\\n` ends the `Content-Disposition` header line entirely, with subsequent bytes interpreted as additional part headers (e.g. a forged `Content-Type`); a second `\\r\\n` ends the whole part header block and prepends attacker bytes to the part body.\n\nThe default-filename path in `add_file/3` derives the name via `Path.basename/1`, which does not strip CR or LF, so any code that forwards a partially attacker-controlled file path is equally vulnerable.\n\n### PoC\n\n1. Call `Tesla.Multipart.add_file_content/4` with a filename containing `\\r\\nX-Injected: evil`.\n2. POST the multipart body to any upstream via any Tesla adapter.\n3. The upstream receives `X-Injected: evil` as a standalone header line on the affected part.\n\n### Impact\n\nLow severity (CVSS v4.0: 2.1). Any application using `tesla` 0.8.0 through 1.18.2 that passes untrusted input into `add_field/4`, `add_file/3`, or `add_file_content/4` disposition parameters is affected. Consequences range from forging part-level headers to body prepending against lenient multipart parsers. Fixed in tesla 1.18.3.\n\n### Workarounds\n\nValidate disposition parameter values before passing them to the multipart API, rejecting any value that contains `\\r`, `\\n`, or `\"`.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e","status":"published","published":"2026-07-10T00:04:37Z","modified":"2026-07-10T00:15:09.250139794Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}