CVE-2026-48598 Details
Description
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A " in the value closes the quoted parameter early; a \r\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \r\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue. This issue affects tesla: from 0.8.0 before 1.18.3.
A vulnerability in the Elixir Tesla library, specifically in versions 0.8.0 prior to 1.18.3, allows for multipart header injection through unescaped Content-Disposition parameter values. The issue arises in the Tesla.Multipart module, where the 'part_headers_for_disposition' function interpolates disposition parameters without validating for carriage return, line feed, or double-quote characters. This lack of validation enables an attacker to close quoted parameters prematurely or inject additional headers and body bytes into multipart requests. The vulnerability can be exploited by passing untrusted input into certain disposition parameters, such as filename or field name, through the 'add_field', 'add_file', or 'add_file_content' functions.
Users can upgrade to Tesla version 1.18.3 or later, where this vulnerability has been fixed. For applications that cannot be immediately upgraded, validate and sanitize disposition parameter values before passing them to the multipart API, rejecting any values that contain carriage return, line feed, or double-quote characters.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 | CISA-ADP | Vendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-48598.html | EEF | MitigationThird Party Advisory |
| https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351 | EEF | |
| https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e | EEF | Patch |
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4 | EEF | Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48598 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-tesla tesla | >= 0.8.0, < 1.18.3 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | EEF |