Improper Encoding in Tesla Affects Elixir Applications

CVE-2026-48598

What is CVE-2026-48598?

An improper encoding vulnerability in Tesla allows for multipart part header injection due to the lack of validation on CR, LF, and double-quote characters in the Content-Disposition header values. When parameters are passed without proper validation, an attacker can manipulate header values, leading to potential injection attacks. This issue arises from the way the Tesla.Multipart.part_headers_for_disposition/1 function handles input from various methods that supply headers, including Tesla.Multipart.add_field/4 and Tesla.Multipart.add_file/3. Affected versions are from 0.8.0 up to 1.18.3, making it critical for developers using Teslar in Elixir applications to implement the patch provided to resolve this vulnerability.

References