PT-2026-45841 · Tesla · Tesla

Jonatan Männchen

+2

·

Published

2026-06-02

·

Updated

2026-06-02

·

CVE-2026-48598

CVSS v4.0

2.1

Low

VectorAV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions tesla versions 0.8.0 through 1.18.2
Description Improper encoding or escaping of output allows multipart part header injection through unescaped Content-Disposition parameter values. The function part headers for disposition() interpolates disposition parameters without validating carriage return (r), line feed ( ), or double-quote characters. These values are received from the caller via add field() (the name parameter), add file() (the filename parameter), and add file content() (the filename parameter and other disposition options). A double-quote character can close a quoted parameter prematurely, while r sequences can terminate the Content-Disposition header to start a new forged header or end the header block to prepend bytes to the part body. Additionally, the default filename path in add file() uses Path.basename(), which does not strip carriage returns or line feeds.
Recommendations Update to version 1.18.3. Validate disposition parameter values before passing them to add field(), add file(), or add file content(), rejecting any value containing r, , or double-quotes.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-48598
GHSA-28JH-G32X-V9V4

Affected Products

Tesla