{"id":4189,"date":"2026-09-04T18:43:05","date_gmt":"2026-09-04T10:43:05","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48598"},"modified":"2026-09-04T18:43:05","modified_gmt":"2026-09-04T10:43:05","slug":"cve-2026-48598","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48598","title":{"rendered":"CVE-2026-48598 [LOW] &#8211; Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipa"},"content":{"rendered":"<p>Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.<\/p>\n<p>Tesla.Multipart.part_headers_for_disposition\/1 interpolates each disposition parameter as #{k}=&#8221;#{v}&#8221; with no validation of CR (r), LF (n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field\/4 (the name parameter), Tesla.Multipart.add_file\/3, and Tesla.Multipart.add_file_content\/4 (both the filename parameter and other disposition opts). A &#8221; in the value closes the quoted parameter early; a rn ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second rn, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file\/3 derives the filename via Path.basename\/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.<\/p>\n<p>This issue affects tesla: from 0.8.0 before 1.18.3.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.<\/p>\n<p>Tesla.Multipart.part_headers_for<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4189","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}