{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Vranljive to\u010dke v Telegram Desktop, ki omogo\u010dajo po\u0161iljanje poljubnih datotek ob klikovanju na povezave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Razkriti so podrobnosti in metoda izkori\u0161\u010danja ranljivosti (CVE-2026-107181) v Telegram Desktop, uradnem odjemalcu Telegram za namizne sisteme. Te\u017eava je posledica neustrezne obdelave neekraniranih lo\u010dilnih znakov v IPC ukazih, kar je omogo\u010dilo, da je ob kliku na poslano povezavo zahteval prenos katerega koli datoteke iz sistema \u017ertve napadalcu, vklju\u010dno z datotekami z sejnimi klju\u010di, ki jih je mogo\u010de uporabiti za prevzem ra\u010duna v Telegramu. Ranljivost je bila odpravljena v razli\u010dici Telegram Desktop 7.2.9.<\/p>\n<p>Ko klikom na poveznice &#171;tg:\/\/&#187; operativni sustav pokre\u0107e aplikaciju Telegram Desktop povezanu s tim tipom poveznica. Ako je u sustavu ve\u0107 pokrenuta druga instanca te aplikacije, pokrenuti proces joj proslje\u0111uje poveznicu putem soketa pomo\u0107u IPC su\u010delja. Problem je u tome \u0161to, ako se karakter &#171;;&#187; navede me\u0111u parametrima poveznice (na primjer, &#171;tg:\/\/x?a=1;OPEN&#8230;&#187;), sadr\u017eaj se dijeli, a dijelovi koji dolaze nakon karaktera &#171;;&#187; obra\u0111uju se kao odvojene naredbe.<\/p>\n<p>Za izvr\u0161enje napada koristi se naredba OPEN zajedno s URI shemom &#171;interpret:&#187;, namijenjenom za pokretanje pomo\u0107nih skripti putem IPC, koje su se koristile za automatsko slanje novih izdanja u kanale. Skripta predstavlja unaprijed definiranu lokalnu datoteku koja sadr\u017ei datoteku koja se \u0161alje u kanal i identifikator kanala. Putanja do skripti obra\u0111uje se relativno prema pomo\u0107nom poddirektoriju, ali zbog nedostatka \u010di\u0161\u0107enja &#171;..&#187; u putanjama do datoteka, napada\u010d ima mogu\u0107nost pristupa datotekama pohranjenim izvan osnovnog direktorija. Na primjer, mo\u017ee u\u010ditati datoteku u svoju telegram grupu, nakon \u010dega se mo\u017ee pozvati na tu datoteku kao na skriptu pripremaju\u0107i poveznicu tipa:<\/p>\n<p>   tg:\/\/x?a=1;OPEN:interpret:..\/..\/..\/Downloads\/Telegram%20Desktop\/instructions.txt<\/p>\n<p>Faze izvajanja napada:<\/p>\n<ul>\n<li class=\"l\"> Napadalec doda \u017ertev v svojo skupino (pri privzetih nastavitvah dodajanje ne zahteva potrditev dodane osebe) in v to skupino po\u0161lje besedilno datoteko, v kateri je navedena kanal in pot do skripta. Telegram bo to datoteko shranil v predhodno dolo\u010den sistemski poddirektorij, ko \u017ertev vstopi v skupino.\n<p>   kanal: 2005234537<br \/>\n   datoteka: tdata\/D877F783D5D3EF8Cs<\/p>\n<li class=\"l\">Napada\u010d \u0161alje \u017ertvi nevino izgledaju\u0107u poveznicu na svoj host (na primjer, &#171;https:\/\/coolsite.org&#187;), koja se prilikom otvaranja preusmjerava na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/server\/dts-dronten\/\"   title=\"stre\u017enikom\" data-wpil-keyword-link=\"linked\">stre\u017enikom<\/a> napada\u010da i zamjenjuje se URI-em &#8216;tg:\/\/x?a=1;OPEN:interpret:&#8230;;OPEN:interpret:&#8230;.\n<li class=\"l\"> Kada se klikne na poveznicu, preglednik poziva obrtnika URI-a &#171;tg:\/\/&#187;, pokre\u0107u\u0107i prethodno spomenuti niz komandi koji dovodi do slanja datoteka u kanal napada\u010da bez prikazivanja bilo kakvih obavijesti i bez zahtjeva za potvrdom slanja.\n<li class=\"l\"> Ko napadalec pridobi datoteke iz podmape tdata z klju\u010dem za \u0161ifriranje in avtorizacijo, lahko v odsotnosti lokalne geslo, ki ga nastavite uporabnik, klonira povezavo \u017ertve na svojem napravi.\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66431\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0435\u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432-\u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 IPC, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u043c\u0438 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 Telegram. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183718","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-09T08:54:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-09T08:54:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivost v Telegram Desktop, ki omogo\u010da po\u0161iljanje poljubnih datotek ob kliku na povezavo | ProHoster","description":"Razkrili so podrobnosti in metodo izkori\u0161\u010danja ranljivosti (CVE-2026-107181) v Telegram Desktop, uradnem odjemalcu Telegram za namizne sisteme.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Telegram Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0443 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-107181) \u0432 Telegram Desktop, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0435 Telegram \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T08:54:03+00:00","article:modified_time":"2026-10-09T08:54:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=183718"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183718\/revisions"}],"predecessor-version":[{"id":183719,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183718\/revisions\/183719"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=183718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=183718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=183718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}