{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Zranite\u013enos\u0165 v Telegram Desktop, ktor\u00e1 umo\u017e\u0148uje odosla\u0165 \u013eubovo\u013en\u00e9 s\u00fabory kliknut\u00edm na odkaz","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Boli zverejnen\u00e9 podrobnosti a met\u00f3da zneu\u017e\u00edvania zranite\u013enosti (CVE-2026-107181) v Telegram Desktop, ofici\u00e1lnom kliente Telegram pre desktopov\u00e9 syst\u00e9my. Probl\u00e9m je sp\u00f4soben\u00fd nedostato\u010dn\u00fdm spracovan\u00edm neescapovan\u00fdch oddelovac\u00edch znakov v IPC pr\u00edkazoch, \u010do umo\u017enilo pri kliknut\u00ed na zaslan\u00fd odkaz pren\u00e1\u0161a\u0165 ak\u00e9ko\u013evek s\u00fabory zo syst\u00e9mu obete \u00fato\u010dn\u00edkovi, vr\u00e1tane s\u00faborov so s.session k\u013e\u00fa\u010dmi, ktor\u00e9 m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 na prevzatie \u00fa\u010dtu v Telegrame. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo vydan\u00ed Telegram Desktop 7.2.9.<\/p>\n<p>Kliknut\u00edm na odkazy &#171;tg:\/\/&#187; opera\u010dn\u00fd syst\u00e9m spust\u00ed aplik\u00e1ciu Telegram Desktop s\u00favisiacu s t\u00fdmto typom odkazov. Ak je v syst\u00e9me u\u017e spusten\u00e1 in\u00e1 in\u0161tancia tejto aplik\u00e1cie, spusten\u00fd proces odovzd\u00e1 odkazy tomuto procesu pomocou socketu prostredn\u00edctvom IPC rozhrania. Probl\u00e9m je v tom, \u017ee ak je medzi parametrami odkazu zadan\u00fd symbol &#171;;&#187; (napr\u00edklad &#171;tg:\/\/x?a=1;OPEN&#8230;&#187;), obsah sa rozdel\u00ed a \u010dasti nasleduj\u00face za symbolom &#171;;&#187; sa spracov\u00e1vaj\u00fa ako samostatn\u00e9 pr\u00edkazy.<\/p>\n<p>Na uskuto\u010dnenie \u00fatoku je pou\u017eit\u00fd pr\u00edkaz OPEN spolu s URI sch\u00e9mou &#171;interpret:&#187;, ktor\u00e1 je ur\u010den\u00e1 na sp\u00fa\u0161\u0165anie skriptov cez IPC, ktor\u00e9 sa pou\u017e\u00edvali na automatick\u00e9 odosielanie nov\u00fdch vydan\u00ed do kan\u00e1lov. Skript je vopred definovan\u00fd lok\u00e1lny s\u00fabor, ktor\u00fd obsahuje s\u00fabor odosielan\u00fd do kan\u00e1la a identifik\u00e1tor kan\u00e1la. Cesta k skriptom sa spracov\u00e1va relat\u00edvne k pomocn\u00e9mu podadres\u00e1ru, ale pre nedostatok \u010distenia &#171;..&#187; v s\u00faborov\u00fdch cest\u00e1ch m\u00e1 \u00fato\u010dn\u00edk mo\u017enos\u0165 odkazova\u0165 na s\u00fabory ulo\u017een\u00e9 mimo z\u00e1kladn\u00e9ho adres\u00e1ra. Napr\u00edklad, m\u00f4\u017ee nahra\u0165 s\u00fabor do svojej telegramovej skupiny a potom na tento s\u00fabor odk\u00e1za\u0165 ako na skript, pripraviac odkaz typu:<\/p>\n<p>   tg:\/\/x?a=1;OPEN:interpret:..\/..\/..\/Downloads\/Telegram%20Desktop\/instructions.txt<\/p>\n<p>Kroky pri vykon\u00e1van\u00ed \u00fatoku:<\/p>\n<ul>\n<li class=\"l\"> \u00dato\u010dn\u00edk prid\u00e1 obe\u0165 do svojej skupiny (pri predvolenom nastaven\u00ed pridanie nevy\u017eaduje potvrdenie od prid\u00e1vanej osoby) a po\u0161le do tejto skupiny textov\u00fd s\u00fabor, v ktorom je uveden\u00fd kan\u00e1l a cesta k skriptu. Telegram tento s\u00fabor ulo\u017e\u00ed do preddefinovan\u00e9ho syst\u00e9mov\u00e9ho podadres\u00e1ra, ke\u010f obe\u0165 vst\u00fapi do skupiny.\n<p>   channel: 2005234537<br \/>\n   file: tdata\/D877F783D5D3EF8Cs<\/p>\n<li class=\"l\">\u00dato\u010dn\u00edk po\u0161le obeti nevinn\u00fd vyzeraj\u00faci odkaz na svoj hostite\u013e (napr\u00edklad &#171;https:\/\/coolsite.org&#187;), ktor\u00fd sa pri otvoren\u00ed pomocou presmerovania zmen\u00ed na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/server\/dts-dronten\/\"   title=\"serveri\" data-wpil-keyword-link=\"linked\">serveri<\/a> \u00fato\u010dn\u00edka na URI typu &#8216;tg:\/\/x?a=1;OPEN:interpret:&#8230;;OPEN:interpret:&#8230;.\n<li class=\"l\"> Pri kliknut\u00ed na odkaz prehliada\u010d vyvol\u00e1 spracovate\u013e URI &#171;tg:\/\/&#187;, ktor\u00fd sp\u00fa\u0161\u0165a vy\u0161\u0161ie uveden\u00fd re\u0165azec sp\u00fa\u0161\u0165ania pr\u00edkazov, ktor\u00fd vedie k odoslaniu s\u00faborov do kan\u00e1lu \u00fato\u010dn\u00edka bez zobrazenia ak\u00fdchko\u013evek upozornen\u00ed a bez \u017eiadosti o potvrdenie odoslania.\n<li class=\"l\"> Z\u00edskan\u00edm s\u00faborov z podprie\u010dinka tdata s \u0161ifrovac\u00edmi a autentifika\u010dn\u00fdmi k\u013e\u00fa\u010dmi, pri absencii nastaven\u00e9ho miestneho hesla pou\u017e\u00edvate\u013ea, m\u00f4\u017ee \u00fato\u010dn\u00edk klonova\u0165 rel\u00e1ciu pripojenia obete na svojom zariaden\u00ed.\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66431\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0435\u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432-\u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 IPC, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u043c\u0438 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 Telegram. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183718","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-09T08:54:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-09T08:54:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Telegram Desktop, ktor\u00e1 umo\u017e\u0148uje posla\u0165 \u013eubovo\u013en\u00e9 s\u00fabory kliknut\u00edm na odkaz | ProHoster","description":"Boli odhalen\u00e9 podrobnosti a met\u00f3da zneu\u017eitia zranite\u013enosti (CVE-2026-107181) v Telegram Desktop, ofici\u00e1lnom klietovi Telegramu pre stoln\u00e9 syst\u00e9my.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T08:54:03+00:00","article:modified_time":"2026-10-09T08:54:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=183718"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183718\/revisions"}],"predecessor-version":[{"id":183719,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183718\/revisions\/183719"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=183718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=183718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=183718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}