CVE-2026-48598 (GCVE-0-2026-48598)

Vulnerability from cvelistv5 – Published: 2026-06-02 19:08 – Updated: 2026-09-24 21:00
VLAI
Title
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
Summary
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A " in the value closes the quoted parameter early; a \r\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \r\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue. This issue affects tesla: from 0.8.0 before 1.18.3.
Severity
2.1 (Low)
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-03 14:58 UTC
CWE
  • CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
Impacted products
Vendor Product Version CPE status
elixir-tesla tesla Affected: 0.8.0 , < 1.18.3 (semver)
    cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*
Create a notification for this product.
elixir-tesla tesla Affected: 6ebfdb9abe9c6f119408045b933d82462decd351 , < bb1a2c3da2775924d96e3db8e315dcc4d5d2246e (git)
    cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-02 19:08
Credits
Peter Ullrich Yordis Prieto Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48598",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T14:58:39.064613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:00:21.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "tesla",
          "packageURL": "pkg:hex/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "elixir-tesla/tesla",
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "bb1a2c3da2775924d96e3db8e315dcc4d5d2246e",
              "status": "affected",
              "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must pass untrusted input into a disposition parameter of \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e, \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, or \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must pass untrusted input into a disposition parameter of `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`."
            }
          ],
          "value": "The application must pass untrusted input into a disposition parameter of Tesla.Multipart.add_field/4, Tesla.Multipart.add_file/3, or Tesla.Multipart.add_file_content/4."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.18.3",
                  "versionStartIncluding": "0.8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "datePublic": "2026-06-02T19:08:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped \u003ccode\u003eContent-Disposition\u003c/code\u003e parameter values.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Multipart.part_headers_for_disposition/1\u003c/code\u003e interpolates each disposition parameter as \u003ccode\u003e#{k}=\"#{v}\"\u003c/code\u003e with no validation of CR (\u003ccode\u003e\\r\u003c/code\u003e), LF (\u003ccode\u003e\\n\u003c/code\u003e), or double-quote characters. The values come verbatim from the caller via \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e (the \u003ccode\u003ename\u003c/code\u003e parameter), \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, and \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e (both the \u003ccode\u003efilename\u003c/code\u003e parameter and other disposition opts). A \u003ccode\u003e\"\u003c/code\u003e in the value closes the quoted parameter early; a \u003ccode\u003e\\r\\n\u003c/code\u003e ends the \u003ccode\u003eContent-Disposition\u003c/code\u003e header line and starts a new part header (such as a forged \u003ccode\u003eContent-Type\u003c/code\u003e), or, after a second \u003ccode\u003e\\r\\n\u003c/code\u003e, ends the entire part header block and prepends bytes to the part body. The default-filename path in \u003ccode\u003eadd_file/3\u003c/code\u003e derives the filename via \u003ccode\u003ePath.basename/1\u003c/code\u003e, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 0.8.0 before 1.18.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped `Content-Disposition` parameter values.\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates each disposition parameter as `#{k}=\"#{v}\"` with no validation of CR (`\\r`), LF (`\\n`), or double-quote characters. The values come verbatim from the caller via `Tesla.Multipart.add_field/4` (the `name` parameter), `Tesla.Multipart.add_file/3`, and `Tesla.Multipart.add_file_content/4` (both the `filename` parameter and other disposition opts). A `\"` in the value closes the quoted parameter early; a `\\r\\n` ends the `Content-Disposition` header line and starts a new part header (such as a forged `Content-Type`), or, after a second `\\r\\n`, ends the entire part header block and prepends bytes to the part body. The default-filename path in `add_file/3` derives the filename via `Path.basename/1`, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
            }
          ],
          "value": "Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-105",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-105 HTTP Request Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T21:00:20.385Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
        },
        {
          "name": "EEF CNA record for CVE-2026-48598",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48598.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48598",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48598"
        },
        {
          "name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
        },
        {
          "name": "Fix commit bb1a2c3 in elixir-tesla/tesla",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eValidate disposition parameter values before passing them to \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e, \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, or \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e, rejecting any value that contains \u003ccode\u003e\\r\u003c/code\u003e, \u003ccode\u003e\\n\u003c/code\u003e, or \u003ccode\u003e\"\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Validate disposition parameter values before passing them to `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`, rejecting any value that contains `\\r`, `\\n`, or `\"`."
            }
          ],
          "value": "Validate disposition parameter values before passing them to Tesla.Multipart.add_field/4, Tesla.Multipart.add_file/3, or Tesla.Multipart.add_file_content/4, rejecting any value that contains \\r, \\n, or \"."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48598",
    "datePublished": "2026-06-02T19:08:19.921Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-09-24T21:00:20.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48598",
      "date": "2026-09-27",
      "epss": "0.00337",
      "percentile": "0.24562"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Multipart\u0027"
                ],
                "packageName": "tesla",
                "packageURL": "pkg:hex/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/multipart.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "1.18.3",
                    "status": "affected",
                    "version": "0.8.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Multipart\u0027"
                ],
                "packageName": "elixir-tesla/tesla",
                "packageURL": "pkg:github/elixir-tesla/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/multipart.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "bb1a2c3da2775924d96e3db8e315dcc4d5d2246e",
                    "status": "affected",
                    "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                    "versionEndExcluding": "1.18.3",
                    "versionStartIncluding": "0.8.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de codificaci\u00f3n o escape de salida incorrectos en elixir-tesla tesla permite la inyecci\u00f3n de encabezados de parte multipart a trav\u00e9s de valores de par\u00e1metros Content-Disposition sin escape.\n\nTesla.Multipart.part_headers_for_disposition/1 interpola cada par\u00e1metro de disposici\u00f3n como #{k}=\"#{v}\" sin validaci\u00f3n de caracteres CR (\\r), LF (\\n) o comillas dobles. Los valores provienen textualmente del llamador a trav\u00e9s de Tesla.Multipart.add_field/4 (el par\u00e1metro \u0027name\u0027), Tesla.Multipart.add_file/3, y Tesla.Multipart.add_file_content/4 (tanto el par\u00e1metro \u0027filename\u0027 como otras opciones de disposici\u00f3n). Una \u0027 en el valor cierra el par\u00e1metro entre comillas prematuramente; un \\r\\n termina la l\u00ednea del encabezado Content-Disposition y comienza un nuevo encabezado de parte (como un Content-Type falsificado), o, despu\u00e9s de un segundo \\r\\n, termina todo el bloque de encabezados de parte y antepone bytes al cuerpo de la parte. La ruta de nombre de archivo predeterminada en add_file/3 deriva el nombre de archivo a trav\u00e9s de Path.basename/1, que no elimina CR o LF, por lo que cualquier aplicaci\u00f3n que reenv\u00ede una ruta de archivo parcialmente controlada por el atacante hereda el mismo problema.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
          }
        ],
        "id": "CVE-2026-48598",
        "lastModified": "2026-09-24T21:17:13.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48598",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T14:58:39.064613Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-02T20:16:38.847",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Mitigation",
              "Third Party Advisory"
            ],
            "url": "https://cna.erlef.org/cves/CVE-2026-48598.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48598"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-04T10:03:56+00:00",
      "cve": "CVE-2026-48598",
      "id": "CVE-2026-48598",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48598.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48598",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-03T14:58:39.064613Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-03T14:56:59.609Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Multipart\u0027"
              ],
              "packageName": "tesla",
              "packageURL": "pkg:hex/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/multipart.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "1.18.3",
                  "status": "affected",
                  "version": "0.8.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Multipart\u0027"
              ],
              "packageName": "elixir-tesla/tesla",
              "packageURL": "pkg:github/elixir-tesla/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/multipart.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:part_headers_for_disposition/1"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_field/4"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file/3"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_file_content/4"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "bb1a2c3da2775924d96e3db8e315dcc4d5d2246e",
                  "status": "affected",
                  "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must pass untrusted input into a disposition parameter of \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e, \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, or \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The application must pass untrusted input into a disposition parameter of `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`."
                }
              ],
              "value": "The application must pass untrusted input into a disposition parameter of Tesla.Multipart.add_field/4, Tesla.Multipart.add_file/3, or Tesla.Multipart.add_file_content/4."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.18.3",
                      "versionStartIncluding": "0.8.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Yordis Prieto"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "datePublic": "2026-06-02T19:08:19.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped \u003ccode\u003eContent-Disposition\u003c/code\u003e parameter values.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Multipart.part_headers_for_disposition/1\u003c/code\u003e interpolates each disposition parameter as \u003ccode\u003e#{k}=\"#{v}\"\u003c/code\u003e with no validation of CR (\u003ccode\u003e\\r\u003c/code\u003e), LF (\u003ccode\u003e\\n\u003c/code\u003e), or double-quote characters. The values come verbatim from the caller via \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e (the \u003ccode\u003ename\u003c/code\u003e parameter), \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, and \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e (both the \u003ccode\u003efilename\u003c/code\u003e parameter and other disposition opts). A \u003ccode\u003e\"\u003c/code\u003e in the value closes the quoted parameter early; a \u003ccode\u003e\\r\\n\u003c/code\u003e ends the \u003ccode\u003eContent-Disposition\u003c/code\u003e header line and starts a new part header (such as a forged \u003ccode\u003eContent-Type\u003c/code\u003e), or, after a second \u003ccode\u003e\\r\\n\u003c/code\u003e, ends the entire part header block and prepends bytes to the part body. The default-filename path in \u003ccode\u003eadd_file/3\u003c/code\u003e derives the filename via \u003ccode\u003ePath.basename/1\u003c/code\u003e, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 0.8.0 before 1.18.3.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped `Content-Disposition` parameter values.\n\n`Tesla.Multipart.part_headers_for_disposition/1` interpolates each disposition parameter as `#{k}=\"#{v}\"` with no validation of CR (`\\r`), LF (`\\n`), or double-quote characters. The values come verbatim from the caller via `Tesla.Multipart.add_field/4` (the `name` parameter), `Tesla.Multipart.add_file/3`, and `Tesla.Multipart.add_file_content/4` (both the `filename` parameter and other disposition opts). A `\"` in the value closes the quoted parameter early; a `\\r\\n` ends the `Content-Disposition` header line and starts a new part header (such as a forged `Content-Type`), or, after a second `\\r\\n`, ends the entire part header block and prepends bytes to the part body. The default-filename path in `add_file/3` derives the filename via `Path.basename/1`, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
                }
              ],
              "value": "Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.\n\nTesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}=\"#{v}\" with no validation of CR (\\r), LF (\\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A \" in the value closes the quoted parameter early; a \\r\\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \\r\\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-105",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-105 HTTP Request Splitting"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper Encoding or Escaping of Output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-24T21:00:20.385Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4"
            },
            {
              "name": "EEF CNA record for CVE-2026-48598",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48598.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-48598",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48598"
            },
            {
              "name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla",
              "tags": [
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
            },
            {
              "name": "Fix commit bb1a2c3 in elixir-tesla/tesla",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/bb1a2c3da2775924d96e3db8e315dcc4d5d2246e"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eValidate disposition parameter values before passing them to \u003ccode\u003eTesla.Multipart.add_field/4\u003c/code\u003e, \u003ccode\u003eTesla.Multipart.add_file/3\u003c/code\u003e, or \u003ccode\u003eTesla.Multipart.add_file_content/4\u003c/code\u003e, rejecting any value that contains \u003ccode\u003e\\r\u003c/code\u003e, \u003ccode\u003e\\n\u003c/code\u003e, or \u003ccode\u003e\"\u003c/code\u003e.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Validate disposition parameter values before passing them to `Tesla.Multipart.add_field/4`, `Tesla.Multipart.add_file/3`, or `Tesla.Multipart.add_file_content/4`, rejecting any value that contains `\\r`, `\\n`, or `\"`."
                }
              ],
              "value": "Validate disposition parameter values before passing them to Tesla.Multipart.add_field/4, Tesla.Multipart.add_file/3, or Tesla.Multipart.add_file_content/4, rejecting any value that contains \\r, \\n, or \"."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48598",
        "datePublished": "2026-06-02T19:08:19.921Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-09-24T21:00:20.385Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.