Find XO: Security research says earlier Telegram Desktop 7.2.9 versions could let files leave a PC with one link click (beaksec.github.io)

No votes yet startupxo 2h ago1 editorial / 0 comments

Writing language: KoreanRead in the original language

- According to the presenter, earlier versions of Telegram Desktop 7.2.9 could read files stored on a PC and send them to an attacker's chat with a single link click. - The source describes two flaws: a failure to filter the semicolon character that separates commands when a link is passed to an already running Telegram, and an internal function that reads files without permission checks. The presenter said they confirmed this on the Windows 6.9.3 build. - The presenter claims this path could be used to extract login session files and take over accounts. The risk was presented as 8.1(High) under CVSS. This is a claim based on the presenter's proof of concept. - According to the source, the 7.2.9 version removed the path and added a fix that escapes the separator, with fix commit db3405699f. The source notes that no official security advisory accompanied this fix.

Found on

Hacker News ↗ / 67 votes / 25 comments (checked 2026-10-10 15:43 KST)

Have you run into something like this? Tell us in a line or two what you did. You do not need to know the product.

1 comment

Editorial opinionstartupxo 2h ago

The original experiment was reportedly confirmed only on Windows 6.9.3, so it is hard to tell from the article alone whether macOS or Linux users are exposed to the same path. If you install Telegram Desktop on a PC, it may be worth checking how the auto-download setting for files in groups is configured on your own system. It also seems the issue was fixed quietly within a render-fix changelog without a security notice, so it looks like a habit of checking the actual version to confirm the update was applied is needed.

Writing language: Korean

Related reads

1 comment