{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"A vulnerability in Telegram Desktop that allows arbitrary files to be sent when clicking on a link","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Details and exploitation method of the vulnerability (CVE-2026-107181) in Telegram Desktop, the official Telegram client for desktop systems, have been revealed. The issue stems from inadequate handling of unescaped delimiter characters in IPC commands, which allowed an attacker to transfer any files from the victim's system to themselves by clicking on a sent link, including files containing session keys that can be used to hijack a Telegram account. The vulnerability has been resolved in Telegram Desktop version 7.2.9.<\/p>\n
When clicking on links like «tg:\/\/», the operating system launches the associated application Telegram Desktop. If another instance of this application is already running, the launched process passes the link to it via a socket using the IPC interface. The problem is that if the character «;» is specified among the link parameters (for example, «tg:\/\/x?a=1;OPEN…»), the content is split, and the parts after the «;» character are processed as separate commands.<\/p>\n
The attack involves the OPEN command along with the URI scheme «interpret:», intended for executing service scripts via IPC, which were used for automatically sending new releases to channels. The script consists of a predefined local file that specifies the file sent to the channel and the channel identifier. The file path to the scripts is processed relative to the service subdirectory, but due to a lack of sanitization of «..» in the file paths, the attacker can access files saved outside the base directory. For example, a file can be uploaded to their Telegram group, after which this file can be referenced as a script by preparing a link like:<\/p>\n
The attacker adds the victim to their group (by default, adding requires no confirmation from the added party) and sends a text file to this group, which specifies the channel and path to the script. Telegram will save this file in a predefined system subdirectory when the victim joins the group.\n