praktor Telegram upload path traversal writes files outside uploads

high severity · published 2026-10-30

A remote Telegram user who can message the bot can upload a file with a crafted name whose path escapes the uploads folder and lands anywhere in the persistent agent workspace. By default the bot accepts messages from any sender, so no authentication is needed to abuse this.

CVE: CVE-2026-62331

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 659 and your operating system.