{"id":"GHSA-px9f-whj3-246m","summary":"Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type","details":"### Summary\n\nReq's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into the part headers without escaping. An attacker who can influence any of those values can inject CRLF-separated header lines, smuggle additional form fields, or prepend a whole extra part into the request the victim service sends downstream.\n\n### Details\n\n`Req.Utils.encode_form_part/2` in `lib/req/utils.ex` builds the per-part header iodata by concatenating the three caller-supplied strings verbatim into `content-disposition: form-data; name=\"\u003cname\u003e\"; filename=\"\u003cfilename\u003e\"` and `content-type: \u003ccontent_type\u003e`. There is no CRLF stripping, no quote escaping, and no validation. A value containing `\"\\r\\n` closes the surrounding quoted value and starts a new header line; an additional `\\r\\n--\u003cboundary\u003e` terminates the current part and lets the attacker prepend a smuggled part.\n\nThe flaw is reachable through every supported way of supplying a part. It is especially easy to hit when `value` is a `%File.Stream{}`, because `filename` then defaults to `Path.basename(stream.path)` and POSIX filenames may legitimately contain `\\r` and `\\n`. RFC 7578 / WHATWG form-data requires percent-encoding `\"`, CR, and LF in these fields; the fix adopts that behavior.\n\n### PoC\n\n1. Construct a malicious `filename` such as `harmless.txt\"\\r\\nX-Smuggled: marker\\r\\nContent-Disposition: form-data; name=\"pwned`.\n2. Call `Req.post!(url, form_multipart: [upload: {\"benign body\", filename: \u003cmalicious\u003e, content_type: \"text/plain\"}])`.\n3. The emitted multipart body contains a real `X-Smuggled:` header line and an extra `Content-Disposition` for `name=\"pwned\"`, alongside Req's legitimate headers.\n\n### Impact\n\nHTTP request smuggling / multipart parameter smuggling in the HTTP client. Any application using Req to send `form_multipart` requests where any of `name`, `filename`, or `content_type` can be influenced by an untrusted source is affected, most commonly upload proxies and re-uploaders that derive `filename` from `Path.basename/1` on a user-controlled path.","aliases":["CVE-2026-49756","EEF-CVE-2026-49756"],"modified":"2026-07-29T15:52:24.126273077Z","published":"2026-07-29T15:29:14Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-29T15:29:14Z","nvd_published_at":"2026-06-08T16:16:44Z","cwe_ids":["CWE-93"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49756"},{"type":"WEB","url":"https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-49756.html"},{"type":"PACKAGE","url":"https://github.com/wojtekmach/req"},{"type":"WEB","url":"https://github.com/wojtekmach/req/releases/tag/v0.6.0"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-49756"}],"affected":[{"package":{"name":"req","ecosystem":"Hex","purl":"pkg:hex/req"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.3"},{"fixed":"0.6.0"}]}],"versions":["0.5.10","0.5.11","0.5.12","0.5.13","0.5.14","0.5.15","0.5.16","0.5.17","0.5.18","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px9f-whj3-246m/GHSA-px9f-whj3-246m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}