The vulnerability in wojtekmach req (version 0.5.3) is due to improper neutralization of CRLF sequences in multipart form data construction. The function Req.Utils.encode_form_part/2 builds multipart headers by directly inserting caller-controlled strings (name, filename, content_type) into content-disposition and content-type headers without sanitization. This allows an attacker to inject CRLF characters to prematurely terminate header lines and inject additional headers or multipart sections, effectively enabling multipart parameter smuggling. This is especially exploitable when filenames come from File.Stream paths, which may contain CR or LF characters. The vulnerability affects any usage of Req.post/2 with form_multipart: true that forwards user-controlled multipart metadata downstream.

An attacker can inject arbitrary headers or additional multipart parts into HTTP requests sent by applications using the vulnerable req version. This can lead to multipart parameter smuggling, potentially causing the downstream service to process maliciously crafted multipart data. The impact is limited by the low CVSS score (2.1) and requires local or low-privilege attacker influence on multipart metadata. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid forwarding user-controlled filenames, field names, or MIME types through Req.post/2 with form_multipart enabled. Sanitize or validate multipart metadata to strip or escape CR and LF characters before passing them to the req library. Monitor vendor channels for updates and apply official patches once available.