SZB-e226362c36
EUVD-2026-114361 reports attacker-controlled filenames in praktor Telegram uploads
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- praktor
- Product
- praktor
- First seen
Summary
The EUVD listing says that before version 0.9.1, both Telegram upload sites in praktor's internal/telegram/bot.go concatenate an attacker-controlled document filename into a path. It assigns a CVSS v3.1 score of 8.2.
If you use praktor
Upgrade praktor to version 0.9.1 or later
Limit which Telegram users can upload files to the bot
Check upload directories for unexpected file names or locations
What the sources say 1
· Mastodon: “Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename...” Source