CVE-2026-62331: praktor path traversal via Telegram document upload filenames

Summary

praktor, a multi-agent Claude Code orchestrator with Telegram input, has a path traversal flaw in both Telegram upload sites in `internal/telegram/bot.go` before 0.9.1. The attacker-controlled document filename is concatenated into the destination path without sanitization, and `path.Join` collapses parent-directory traversal, so a remote Telegram user can write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. With `allow_from: []`, which permits all senders by default, no authentication is needed, and the attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook or configuration files that the agent reads on later runs. The demonstrated write scope is the workspace volume, not the unrestricted host filesystem.

Mitigation

Fixed in version 0.9.1.

Related items

• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database
• MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSame vendor · GitHub Advisory Database
• HighGHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthSame vendor · GitHub Advisory Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSame vendor · GitHub Advisory Database