{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Vulnerabilit\u0101te Telegram Desktop, kas \u013cauj nos\u016bt\u012bt patva\u013c\u012bgus failus, noklik\u0161\u0137inot uz saites","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Atkl\u0101ti s\u012bki izkl\u0101st\u012bti un apspriesti ekspluat\u0101cijas pa\u0146\u0113mieni, kas saist\u012bti ar ievainojam\u012bbu (CVE-2026-107181) Telegram Desktop, ofici\u0101laj\u0101 Telegram klient\u0101 darbvirsmas sist\u0113m\u0101m. Probl\u0113ma radusies, jo netika pien\u0101c\u012bgi apstr\u0101d\u0101ti neizsij\u0101ti atdal\u012bt\u0101ji IPC komand\u0101s, kas \u013c\u0101va, noklik\u0161\u0137inot uz nos\u016bt\u012bt\u0101s saites, uzbruc\u0113jam organiz\u0113t jebkuru failu nos\u016bt\u012b\u0161anu no upura sist\u0113mas, ieskaitot sesijas atsl\u0113gu failus, kurus var izmantot, lai sagcapturetu Telegram kontu. Ievainojam\u012bba nov\u0113rsta Telegram Desktop 7.2.9 izlaidum\u0101.<\/p>\n<p>Noklik\u0161\u0137inot uz saites &#171;tg:\/\/&#187;, oper\u0113t\u0101jsist\u0113ma palaid\u012bs ar \u0161o saites veidu saist\u012bto lietotni Telegram Desktop. Ja sist\u0113m\u0101 jau ir atv\u0113rts cits \u0161\u012b lietojumprogrammas instances, tad atv\u0113rt\u0101 procesa sazi\u0146a nodos to saiti, izmantojot socket, izmantojot IPC interfazes. Probl\u0113ma ir t\u0101da, ka, ja saites parametros nor\u0101d\u012bs simbolu &#171;;&#187;, piem\u0113ram, &#171;tg:\/\/x?a=1;OPEN&#8230;&#187;, saturs tiek sadal\u012bts un p\u0113c simbola &#171;;&#187; eso\u0161\u0101s da\u013cas tiek apstr\u0101d\u0101tas k\u0101 atsevi\u0161\u0137as komandas.<\/p>\n<p>Uzbrukuma veik\u0161anai tiek izmantota komanda OPEN kop\u0101 ar URI sh\u0113mu &#171;interpret:&#187;, kas paredz\u0113ta sist\u0113mas skriptu izpildei caur IPC, kas tika izmantoti autom\u0101tiskai jaunu laidiena s\u016bt\u012b\u0161anai kan\u0101liem. Skripts ir iepriek\u0161noteikts lok\u0101lais fails, kur\u0101 nor\u0101d\u012bts fails, kas tiek nos\u016bt\u012bts kan\u0101lam, un kan\u0101la identifikators. Fails draugi tiek apstr\u0101d\u0101ts attiec\u012bb\u0101 pret sist\u0113mas apak\u0161direktoriju, ta\u010du sakar\u0101 ar t\u012br\u012b\u0161anas &#171;..&#187; tr\u016bkumu failu ce\u013cos uzbruc\u0113js var piek\u013c\u016bt failiem, kas saglab\u0101ti \u0101rpus pamata direktorijas. Piem\u0113ram, var aug\u0161upiel\u0101d\u0113t failu sav\u0101 telegram grup\u0101, p\u0113c tam nok\u013c\u016bstot uz \u0161o failu k\u0101 uz skriptu, sagatavojot saiti t\u0101d\u0101 veid\u0101:<\/p>\n<p>   tg:\/\/x?a=1;OPEN:interpret:..\/..\/..\/Downloads\/Telegram%20Desktop\/instructions.txt<\/p>\n<p>Uzbrukuma posmi:<\/p>\n<ul>\n<li class=\"l\"> Uzbruc\u0113js pievieno upuri savai grupai (p\u0113c noklus\u0113juma iestat\u012bjumiem pievieno\u0161ana neprasa apstiprin\u0101jumu no pievienot\u0101), un nos\u016bta \u0161aj\u0101 grup\u0101 teksta failu, kur\u0101 nor\u0101d\u012bts kan\u0101ls un ce\u013c\u0161 uz skriptu. Telegram saglab\u0101s \u0161o failu iepriek\u0161 defin\u0113t\u0101 sist\u0113mas apak\u0161map\u0113, kad upuris ieiet grup\u0101.\n<p>   channel: 2005234537<br \/>\n   file: tdata\/D877F783D5D3EF8Cs<\/p>\n<li class=\"l\">Uzbruc\u0113js nos\u016bta upurim nevain\u012bgi izskat\u012bgu saiti uz savu hostu (piem\u0113ram, &#171;https:\/\/coolsite.org&#187;), kas, atverot, tiks novirz\u012bts uz <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/lv\/server\/dts-dronten\/\"   title=\"serveri\" data-wpil-keyword-link=\"linked\">serveri<\/a> uzbruc\u0113ja URI form\u0101t\u0101 &#8216;tg:\/\/x?a=1;OPEN:interpret:&#8230;;OPEN:interpret:&#8230;.\n<li class=\"l\"> Noklik\u0161\u0137inot uz saites, p\u0101rl\u016bks izsauc URI apstr\u0101d\u0101t\u0101ju &#171;tg:\/\/&#187;, kur\u0161 palai\u017e iepriek\u0161 min\u0113to komandu izpildes \u0137\u0113di, kas noved pie failu nos\u016bt\u012b\u0161anas uzbruc\u0113ja kan\u0101lam bez jebk\u0101d\u0101m pazi\u0146ojumiem un bez apstiprin\u0101juma piepras\u012bjuma nos\u016bt\u012b\u0161anas.\n<li class=\"l\"> Sa\u0146emot failus no apak\u0161direktorija tdata ar \u0161ifr\u0113\u0161anas un autoriz\u0101cijas atsl\u0113g\u0101m, ja lietot\u0101js nav iestat\u012bjis viet\u0113j\u0101 paroli, uzbruc\u0113js var noklon\u0113t upura savienojuma sesiju sav\u0101 ier\u012bc\u0113.\n<\/ul>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66431\">opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0435\u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432-\u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 IPC, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u043c\u0438 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 Telegram. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183718","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-09T08:54:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-09T08:54:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba Telegram Desktop, kas \u013cauj nos\u016bt\u012bt nejau\u0161us failus, noklik\u0161\u0137inot uz saites | ProHoster","description":"Atkl\u0101ti s\u012bk\u0101ki dati un ekspluat\u0101cijas metode par ievainojam\u012bbu (CVE-2026-107181) Telegram Desktop, ofici\u0101laj\u0101 Telegram klient\u0101 galddatoriem.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T08:54:03+00:00","article:modified_time":"2026-10-09T08:54:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=183718"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183718\/revisions"}],"predecessor-version":[{"id":183719,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183718\/revisions\/183719"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=183718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=183718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=183718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}