praktor: unsanitized Telegram upload filename writes outside uploads/ into the persistent agent workspace

CVSS 8.2CVE-2026-62331AI/ML frameworks & servingcurated

Impact

Both Telegram upload paths in internal/telegram/bot.go join the sender-supplied document filename into a destination path without sanitization, and path.Join collapses ../ segments, so a document upload can write anywhere in the agent workspace volume mounted at /workspace/agent. The payoff is not a crash but persistence: the attacker can plant or overwrite CLAUDE.md, skill, hook and configuration files that the Claude agent reads on every later run, turning one upload into stored instruction injection that steers whatever the agent is allowed to do on the fleet - repo checkouts, credentials reachable from the container, jobs it submits. Because the shipped default is allow_from: [] (all senders permitted), anyone who can find and message the bot needs no account or prior access. The advisory scopes the demonstrated write to the persistent workspace volume, not the host filesystem.

Who can reach it

Any remote Telegram user who can message the bot. No authentication or prior privilege in the default allow_from: [] configuration; restricting allow_from to known senders reduces it to an authenticated-sender attack.

What to do

Upgrade to praktor 0.9.1 and restart the orchestrator service - a container/daemon restart, no node disruption. Set allow_from to an explicit sender allow-list rather than leaving it empty. Treat the existing /workspace/agent volume as suspect: inspect CLAUDE.md, instruction, skill, hook and config files for unexpected edits before restarting the agent, since planted instructions survive the upgrade.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-62331 https://github.com/mtzanidakis/praktor/security/advisories/GHSA-48v2-6jcm-fc99 https://github.com/mtzanidakis/praktor/commit/c3731eeda01c0b3ec1dbd13cccd5a147c3182141 https://github.com/mtzanidakis/praktor/releases/tag/v0.9.1

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.