CVE-2026-62331— praktor: Telegram upload traversal permits persistent agent instruction injection

Quick assessment

Affected

mtzanidakis praktor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Praktor 是一个支持 Telegram 输入输出的多智能体 Claude Code 编排器，具备 Docker 隔离环境和 Mission Control 管理界面。在 0.9.1 版本之前，中的两个 Telegram 上传站点会将攻击者可控的文档文件名直接拼接到目标路径中，且未进行任何净化处理；而函数会消除父目录遍历字符（如）。因此，任何能够向该机器人发送消息的远程 Telegram 用户，均可在持久化智能体工作区（挂载于）的目录之外写入文件。由于默认配置中允许所有发送者，该漏洞利用无需任何前置

CVSS 8.2 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1566 · Phishing T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
mtzanidakis	praktor	`< 0.9.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

praktor: Telegram upload traversal permits persistent agent instruction injection

Source: CVE Program / CVE List V5

Vulnerability Description

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtzanidakis	praktor	< 0.9.1	-

II. Public POCs for CVE-2026-62331

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62331

请登录查看更多情报信息。

Other References for CVE-2026-62331 (4)

https://github.com/mtzanidakis/praktor/pull/228 x_refsource_MISC
https://github.com/mtzanidakis/praktor/releases/tag/v0.9.1 x_refsource_MISC
https://github.com/mtzanidakis/praktor/security/advisories/GHSA-48v2-6jcm-fc99 x_refsource_CONFIRM
https://github.com/mtzanidakis/praktor/commit/c3731eeda01c0b3ec1dbd13cccd5a147c3182141 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62331

IV. Related Vulnerabilities

Same weakness: CWE-22