CVE-2026-62331 with a CVSS score of 8.2 is a path traversal vulnerability in the Telegram file upload handling of the praktor Go application, affecting the range Through v0.9.0 (and HEAD 3902d29). The flaw occurs because an attacker-controlled Telegram document filename is concatenated into a destination path without sanitization at both upload sites in internal/telegram/bot.go and then resolved with path.Join, which collapses ../ sequences. A remote Telegram user who can message the bot can exploit the issue without authentication or prior privilege, because the default bot configuration has no user allowlist and allows all users. By supplying a filename such as ../../../CLAUDE.md, the attacker can write files outside the documented uploads/ directory into the persistent agent workspace volume, mounted at /workspace/agent. This enables planting or overwriting files that the agent later reads, including CLAUDE.md, instruction, skill, hook, or configuration files, turning an upload into stored instruction injection into the agent's instruction and execution surface. The business impact is high integrity risk, with limited confidentiality impact and no availability impact, because an attacker can alter agent behavior, inject persistent instructions, and undermine trust in automated operations.
We recommend you to update praktor to version 0.9.1.[/subscribe_to_unlock_form]
CVE-2026-62331 with a CVSS score of 8.2 is a path traversal vulnerability in the Telegram file upload handling of the praktor Go application, affecting the range Through v0.9.0 (and HEAD 3902d29). The flaw occurs because an attacker-controlled Telegram document filename is concatenated into a destination path without sanitization at both upload sites in internal/telegram/bot.go and then resolved with path.Join, which collapses ../ sequences. A remote Telegram user who can message the bot can exploit the issue without authentication or prior privilege, because the default bot configuration has no user allowlist and allows all users. By supplying a filename such as ../../../CLAUDE.md, the attacker can write files outside the documented uploads/ directory into the persistent agent workspace volume, mounted at /workspace/agent. This enables planting or overwriting files that the agent later reads, including CLAUDE.md, instruction, skill, hook, or configuration files, turning an upload into stored instruction injection into the agent's instruction and execution surface. The business impact is high integrity risk, with limited confidentiality impact and no availability impact, because an attacker can alter agent behavior, inject persistent instructions, and undermine trust in automated operations.
We recommend you to update praktor to version 0.9.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]