{"id":"CVE-2026-62331","kind":"vulnerability","aliases":["CVE-2026-62331"],"related":[],"title":"praktor: Telegram file upload lets remote users write outside uploads folder","description":"praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.","summary":"praktor is a multi-agent Claude Code orchestrator driven through Telegram. Its Telegram upload handler joins the attacker-supplied filename into a path without sanitizing it, so a remote Telegram user can write files into the agent workspace and plant instruction files like CLAUDE.md that later agent runs read and act on.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-code","docker","praktor","telegram"],"not_affected_if":["allow-from-restricted","telegram-disabled","version-0.9.1-or-later"],"how_to_check":"- Check the praktor version in use; affected if below `0.9.1`\n- Check `allow_from` in the praktor configuration; `allow_from: []` lets any Telegram sender reach the upload path\n- Look for unexpected `CLAUDE.md`, skill, hook or config files under the `/workspace/agent` volume","fix":"- praktor: move to `0.9.1`","status":"open","published_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:25:54+00:00","updated_at":"2026-10-30T19:25:54+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-30T19:25:54Z","model":"claude-haiku-5-5","output":{"fix":"- praktor: move to `0.9.1`","reach":"internet","title":"praktor: Telegram file upload lets remote users write outside uploads folder","impact":"high","summary":"praktor is a multi-agent Claude Code orchestrator driven through Telegram. Its Telegram upload handler joins the attacker-supplied filename into a path without sanitizing it, so a remote Telegram user can write files into the agent workspace and plant instruction files like CLAUDE.md that later agent runs read and act on.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["praktor","claude-code","telegram","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker plants instructions the agent later executes from workspace","analyst_note":"","how_to_check":"- Check the praktor version in use; affected if below `0.9.1`\n- Check `allow_from` in the praktor configuration; `allow_from: []` lets any Telegram sender reach the upload path\n- Look for unexpected `CLAUDE.md`, skill, hook or config files under the `/workspace/agent` volume","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.9.1-or-later","allow-from-restricted","telegram-disabled"],"who_is_affected":"Teams running praktor below 0.9.1 with Telegram input enabled. The default `allow_from: []` accepts messages from any sender, so no account is needed in that configuration. Exposure is limited to the persistent agent workspace volume mounted at `/workspace/agent`, not the whole host filesystem.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4371,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62331':14A,17A '/workspace/agent':151C '0.9.1':103C,227C 'across':191C 'act':79B 'agent':32B,65B,75B,85C,147C,186C,211C 'ai':19B 'ai-tool':18B 'allow':153C 'arbitrari':205C 'arbitrary-writ':204C 'attack':46B,113C,171C 'attacker-control':112C 'attacker-suppli':45B 'authent':162C 'bot':138C 'claud':22B,33B,86C,185C 'claude-cod':21B 'claude.md':72B,176C 'code':23B,34B,87C 'collaps':125C 'concaten':110C 'configur':169C,181C 'control':99C,114C 'cve':12A,15A 'default':159C 'demonstr':203C 'destin':119C 'directori':128C 'docker':24B,94C 'document':115C,196C 'driven':36B 'file':3A,62B,70B,182C 'filenam':48B,116C 'filesystem':219C 'fix':224C 'folder':11A 'handler':42B 'hook':179C 'host':218C 'host-filesystem':217C 'inject':201C 'input':91C 'instruct':69B,177C,200C 'internal/telegram/bot.go':109C 'isol':95C 'issu':222C 'join':43B 'later':74B,192C 'let':5A 'like':71B 'messag':136C 'mission':98C 'mount':149C 'multi':31B,84C 'multi-ag':30B,83C 'oper':189C 'orchestr':35B,88C 'output':93C 'outsid':9A,142C 'overwrit':175C 'parent':127C 'parent-directori':126C 'path':51B,120C 'path.join':124C 'permit':155C 'persist':146C,210C 'plant':68B,173C 'praktor':1A,25B,27B,80C 'prior':101C,161C 'privileg':164C 'read':77B,187C 'remot':6A,57B,131C 'requir':166C 'run':76B,193C 'sanit':53B,122C 'scope':207C 'sender':157C 'site':107C 'skill':178C 'store':199C 'suppli':47B 'telegram':2A,26B,38B,40B,58B,90C,105C,132C 'therefor':140C 'tool':20B 'travers':129C 'turn':194C 'ui':100C 'unrestrict':216C 'upload':4A,10A,41B,106C,143C,197C 'user':7A,59B,133C 'version':226C 'volum':213C 'within':144C 'without':52B,121C 'workspac':66B,148C,212C 'write':8A,61B,141C,206C,220C","nicknames":[],"mitigations":[],"who_affected":"Teams running praktor below 0.9.1 with Telegram input enabled. The default `allow_from: []` accepts messages from any sender, so no account is needed in that configuration. Exposure is limited to the persistent agent workspace volume mounted at `/workspace/agent`, not the whole host filesystem.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T19:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62331","severity":null,"published_at":"2026-10-30T19:18:33+00:00","modified_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}