Live › vulnerability › CVE-2026-62331
praktor is a multi-agent Claude Code orchestrator driven through Telegram. Its Telegram upload handler joins the attacker-supplied filename into a path without sanitizing it, so a remote Telegram user can write files into the agent workspace and plant instruction files like CLAUDE.md that later agent runs read and act on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Teams running praktor below 0.9.1 with Telegram input enabled. The default allow_from: [] accepts messages from any sender, so no account is needed in that configuration. Exposure is limited to the persistent agent workspace volume mounted at /workspace/agent, not the whole host filesystem.
No product ranges from the sources yet.
0.9.1allow_from in the praktor configuration; allow_from: [] lets any Telegram sender reach the upload pathCLAUDE.md, skill, hook or config files under the /workspace/agent volume0.9.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization, and path.Join collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside uploads/ within the persistent agent workspace mounted at /workspace/agent. Because allow_from: [] permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite CLAUDE.md, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-62331")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.