CVE-2026-62331

praktor Telegram uploads can overwrite agent instructions

mtzanidakis · praktor Claude agent orchestrator

First documented disclosure · Review checkpoint

Summary

A crafted document filename can escape uploads and overwrite persistent agent workspace files.

Severity and exploitation evidence

High · 8.2/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Telegram filenames were joined into destination paths without stripping traversal components; parent segments could redirect writes to the workspace root.

Conditions required

An attacker can send a document to the bot. The default empty allow_from setting accepts all senders; a restrictive sender allowlist reduces reachability.

Potential impact

Files such as CLAUDE.md, skills, hooks or configuration inside the agent workspace volume can be planted or overwritten, creating stored instruction injection. This is not unrestricted host filesystem access.

Affected versions and configurations

praktor through 0.9.0 (CNA: before 0.9.1).

Fix and mitigation status

0.9.1 fixes the upload traversal; this is an issue-specific version.

Practical next steps

Upgrade, restrict telegram.allow_from to trusted IDs, and review the persistent workspace for unexpected instruction or hook files. The patch sanitizes upload names and validates the final volume path.

Operating lesson

Untrusted uploads must never share writable paths with agent instructions.

Evidence and limits

The public advisory, fix PR and release all date to June 26; CVE publication followed October 30. The researcher verified the path traversal with the actual container manager; no malicious victim incident is established.

Sources