Executive brief
Tesla is a popular HTTP client library for the Elixir programming language. A vulnerability in how it handles file uploads allows an attacker to manipulate the structure of web requests if they can control filenames or form field names. This could lead to the injection of unauthorized headers or the modification of data sent to other web services.
Technical details
The vulnerability exists in `Tesla.Multipart.part_headers_for_disposition/1` due to improper encoding of `Content-Disposition` parameter values. The library interpolates values like filenames and field names directly into headers without escaping double-quotes or CRLF sequences. An attacker providing a crafted filename containing `\r\n` can terminate the current header and inject arbitrary new headers or even prepend data to the part body. This is a form of multipart smuggling that affects applications passing untrusted input to `add_field/4`, `add_file/3`, or `add_file_content/4`. The issue is fixed in version 1.18.3.
Affected products
- elixir-tesla tesla >= 0.8.0, < 1.18.3
Timeline
- 2026-06-02: disclosed: NVD publication date
- 2026-07-10: advisory: GitHub Advisory published
- 2026-07-10: patched: Fix confirmed in version 1.18.3