Telegram Desktop vulnerability allowed any user's file to be stolen
- ID
- 33995
- Status
- summarized
- Published
- 10 Oct 2026, 11:02 AM
- Fetched
- 10 Oct 2026, 9:51 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 10 Oct 2026, 9:51 PM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_startup_founders
What happened
Telegram Desktop through version 7.2.8 contains CVE-2026-107181, a high-severity (8.1) flaw where an unescaped separator in the app's single-instance IPC allows a crafted link to inject commands. The injected command reaches an internal 'interpret:' URI scheme that reads arbitrary local files—including session files—and sends them to an attacker-controlled chat, enabling one-click account takeover. Fixed in 7.2.9 (commit db3405699f), confirmed on Windows 6.9.3.
Why it matters
If you use Telegram Desktop for work, community, or as a bot/agent interface, update to 7.2.9 or later now; the exploit only needs a clicked link and can steal your session files. Teams should also check how they handle desktop app updates, since an unpatched client leaves accounts open to takeover.
Discussion angle
What local IPC or custom URI schemes does your own product use, and how do you escape user input before passing it between processes? This bug shows a single unescaped separator can turn a clicked link into arbitrary file read.