CVE-2026-48598
published 2026-06-02CVE-2026-48598: Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.34%
26.0th percentile
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.
Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A " in the value closes the quoted parameter early; a \r\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \r\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.
This issue affects tesla: from 0.8.0 before 1.18.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elixir-tesla | tesla | >= 0.8.0 < 1.18.3 | 1.18.3 |
| elixir-tesla | tesla | >= 6ebfdb9abe9c6f119408045b933d82462decd351 < bb1a2c3da2775924d96e3db8e315dcc4d5d2246e | bb1a2c3da2775924d96e3db8e315dcc4d5d2246e |
| nvidia | tesla | >= 0.8.0 < 1.18.3 | 1.18.3 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.1LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
ghsa·2026-07-10
CVE-2026-48598 [LOW] CWE-116 Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
### Summary
`Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition parameter can use unescaped double-quotes to inject extra disposition key-value pairs, or CRLF sequences to inject additional part headers or prepend bytes to the part body.
### Details
`part_headers_for_disposition/1` in `lib/tesla/multipart.ex` formats each disposition parameter as `k="v"` with no sanitization. Values flow in from `add_field/4` (the `name` argument), `add_file/3` and `add_file
VulDB
elixir-tesla up to 1.18.2 escape output (GHSA-28jh-g32x-v9v4)
vuldb·2026-06-03·CVSS 2.1
CVE-2026-48598 [LOW] elixir-tesla up to 1.18.2 escape output (GHSA-28jh-g32x-v9v4)
A vulnerability identified as problematic has been detected in elixir-tesla tesla up to 1.18.2. This impacts an unknown function. The manipulation leads to escaping of output.
This vulnerability is traded as CVE-2026-48598. An attack has to be approached locally. There is no exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-48598.htmlhttps://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246ehttps://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4https://osv.dev/vulnerability/EEF-CVE-2026-48598https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4
2026-06-02
Published