ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-62331

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

Published Oct 30, 2026 · catalog updated Nov 3, 2026 · praktor: Path traversal in

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-62331. EPSS is 0.78%. Act only if a listed version of praktor: Path traversal in is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (praktor: Path traversal in).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.78%
Remediation
Version ranges on file
Affected products
Go github.com/mtzanidakis/praktor · go github.com/mtzanidakis/praktor · golang github.com · vendor mtzanidakis praktor

### Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume ( , mounted at ), escaping the documented directory. The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization ( , at both upload sites) and resolved with , which collapses sequences. A filename like resolved to the root of the agent workspace volume, outside . Because the agent workspace is the persistent working directory the Claude agent reads from and operates on across runs, writing outside lets an attacker plant or overwrite files the agent later consumes — e.g. , agent instruction/skill/hook files, or other config under . This turns a file upload into a stored injection into the agent's instruction/execution surface (CWE-22 path traversal escalating to stored instruction injection). ### Reachability By default the bot has no user allowlist ( means "allow all"), so the only precondition is that a user can message the bot. No authentication or prior privilege is required. ### Affected versions Through (and HEAD ). ### Patched versions , containing PR #228. ### Workarounds Restrict to trusted user IDs to limit who can send uploads to the bot. Upgrading to is the recommended fix. ### Fix (defense in depth) - : apply to the attacker-controlled filename at both upload sites, stripping directory components and . - : now rejects any path that escapes after , protecting future callers. ### Credit Reported privately by [tonghuaroot](https://github.com/tonghuaroot), who provided a detailed root-cause analysis, a deployed end-to-end proof of concept against the real , and fix verification.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/mtzanidakis/praktor0 → 0.9.1
  • go github.com/mtzanidakis/praktor<= 0.9.0
  • golang github.comversion unspecified
  • vendor mtzanidakis praktorversion unspecified

How to fix CVE-2026-62331

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-62331. EPSS is 0.78%. Act only if a listed version of praktor: Path traversal in is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.9.1, <= 0.9.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.78%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 3, 2026 · Go Vulnerability Database

    Detected

    ### Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume ( , mounted at ), escaping the documented directory. The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization ( , at both upload sites) and resolved with , which collapses sequences. A filename like resolved to the roo

  2. Nov 3, 2026 · Go Vulnerability Database

    Fix available

    github.com/mtzanidakis/praktor fixed in 0.9.1

  3. Nov 3, 2026 · Go Vulnerability Database

    Fix available

    github.com/mtzanidakis/praktor fixed in 0.9.1

  4. Nov 3, 2026 · Go Vulnerability Database

    Updated

    ### Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume ( , mounted at ), escaping the documented directory. The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization ( , at both upload sites) and resolved with , which collapses sequences. A filename like resolved to the roo

Sources

  • CVE.orgVulnerability recordCVE-2026-62331

    praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in concatenate the attacker-controlled document filename into a destination path without sanitization, and coll

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-48v2-6jcm-fc99

    praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-62331

    A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume (praktor-wk- , mounted at /workspace/agent), escaping the documented uploads/ directory. The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization (internal/telegram/bot.go, at both upload sites) and resolved with path.Join, which

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-48v2-6jcm-fc99

    praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

    osv.dev

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseNov 5, 2026
  • GitLab Advisory DatabaseNov 5, 2026
  • GitHub Advisory DatabaseNov 4, 2026
  • CVE.orgNov 4, 2026