{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb Telegram Desktop, q\u00eb lejon d\u00ebrgimin e skedar\u00ebve t\u00eb arbitruesh\u00ebm me nj\u00eb klikim n\u00eb lidhje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Detajet dhe metoda e shfryt\u00ebzimit t\u00eb dob\u00ebsis\u00eb (CVE-2026-107181) n\u00eb Telegram Desktop, klienti zyrtar i Telegram p\u00ebr sisteme desktop. Problemi shkaktohet nga mungesa e trajtimit t\u00eb duhur t\u00eb simboleve t\u00eb ndar\u00ebsve t\u00eb paekranuar n\u00eb komandat IPC, t\u00eb cilat lejonin q\u00eb me nj\u00eb klikim mbi lidhjen e d\u00ebrguar, t\u00eb mund t\u00eb organizohej transferimi i \u00e7do dosjeje nga sistemi i viktim\u00ebs te sulmuesi, p\u00ebrfshir\u00eb dosjet me \u00e7el\u00ebsat e sesionit, q\u00eb mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb kapur llogarin\u00eb n\u00eb Telegram. Dob\u00ebsia \u00ebsht\u00eb eliminuar n\u00eb versionin Telegram Desktop 7.2.9.<\/p>\n
Kur klikoni n\u00eb lidhjet \u00abtg:\/\/\u00bb, sistemi operativ aktivizon aplikacionin e lidhur me k\u00ebt\u00eb lloj lidhjeje, Telegram Desktop. N\u00ebse nj\u00eb instanc\u00eb tjet\u00ebr e k\u00ebtij aplikacioni \u00ebsht\u00eb e hapur n\u00eb sistem, procesi i hapur i d\u00ebrgon lidhjen p\u00ebrmes socket-it duke p\u00ebrdorur nd\u00ebrfaqen IPC. Problemi \u00ebsht\u00eb se, n\u00ebse p\u00ebrfshihet simbole \u00ab;\u00bb mes parametrave t\u00eb lidhjes (p\u00ebr shembull, \u00abtg:\/\/x?a=1;OPEN\u2026\u00bb), p\u00ebrmbajtja ndahen dhe pjes\u00ebt pas simbolit \u00ab;\u00bb trajtohen si komanda t\u00eb ve\u00e7anta.<\/p>\n
P\u00ebr t\u00eb kryer sulmin, aktivizohet komanda OPEN s\u00eb bashku me URI-n\u00eb \u00abinterpret:\u00bb, e cila \u00ebsht\u00eb projektuar p\u00ebr t\u00eb aktivizuar skriptet sh\u00ebrbyese p\u00ebrmes IPC, t\u00eb cilat jan\u00eb p\u00ebrdorur p\u00ebr d\u00ebrgimin automat t\u00eb versioneve t\u00eb reja n\u00eb kanale. Skripti p\u00ebrb\u00ebn nj\u00eb skedar lokal t\u00eb paracaktuar, n\u00eb t\u00eb cilin \u00ebsht\u00eb treguar skedari q\u00eb d\u00ebrgohet n\u00eb kanal dhe identifikatori i kanalit. Rruga e skedarit p\u00ebr skriptet p\u00ebrpunuar relativisht nga nj\u00eb n\u00ebn-katalog sh\u00ebrbimi, por p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb pastrimit t\u00eb \u00ab..\/\u00bb n\u00eb rrug\u00ebt e skedar\u00ebve, sulmuesi ka mund\u00ebsin\u00eb q\u00eb t\u00eb aksesoj\u00eb skedar\u00ebt e ruajtur jasht\u00eb katalogut baz\u00eb. P\u00ebr shembull, mund t\u00eb ngarkohet nj\u00eb skedar n\u00eb grupin tuaj t\u00eb telegramit, pastaj duke iu referuar k\u00ebtij skedari si skript, duke p\u00ebrgatitur nj\u00eb lidhje t\u00eb till\u00eb:<\/p>\n
Sulmuesi shton viktim\u00ebn n\u00eb grupin e tij (n\u00eb kufijt\u00eb e cil\u00ebsimeve t\u00eb zakonshme, shtimi nuk k\u00ebrkon konfirmim nga i shtuar) dhe d\u00ebrgon n\u00eb k\u00ebt\u00eb grup nj\u00eb dosje teksti, n\u00eb t\u00eb cil\u00ebn \u00ebsht\u00eb specifikuar kanali dhe rruga e skriptit. Telegram do ta ruaj\u00eb k\u00ebt\u00eb dosje n\u00eb nj\u00eb n\u00ebnkatalog t\u00eb paracaktuar sistemor kur viktima t\u00eb hyj\u00eb n\u00eb grup.\n