CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads

Vulnerability ID: CVE-2026-62331
CVSS Score: 8.2
Published: 2026-11-03

CVE-2026-62331 is a high-severity path traversal vulnerability (CWE-22) affecting Praktor versions prior to 0.9.1. Praktor is a multi-agent Claude Code orchestrator that integrates Telegram message handling with isolated Docker container workspaces. Due to improper sanitization of user-controlled filenames during Telegram document uploads, a remote user can escape the designated uploads directory and overwrite arbitrary files within the persistent agent workspace volume. Because the default configuration permits messages from any Telegram user without authentication, an attacker can overwrite critical agent instruction files such as CLAUDE.md, achieving persistent prompt and instruction injection across subsequent agent executions.

TL;DR

An unsanitized filename concatenation flaw in Praktor's Telegram upload handler (< 0.9.1) allows unauthenticated remote users to traverse out of the uploads/ directory and overwrite files in the persistent agent volume (/workspace/agent), resulting in stored instruction injection.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Path Traversal / Stored Instruction Injection (CWE-22)
• Affected Component: internal/telegram/bot.go & internal/container/manager.go
• Attack Vector: Network via Telegram Bot API Document Upload
• CVSS v3.1 Score: 8.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
• EPSS Score: 0.78% (55.90th Percentile)
• Authentication Required: None (in default allow_from: [] configuration)
• Patched Version: Praktor v0.9.1
• CISA KEV Status: Not Listed

Affected Systems

• mtzanidakis/praktor
• praktor: < 0.9.1 (Fixed in: 0.9.1)

Code Analysis

Commit: c3731ee

fix(security): prevent upload filename path traversal out of uploads/ (#228)

diff --git a/internal/container/manager.go b/internal/container/manager.go
index 1234567..89abcdef 100644
--- a/internal/container/manager.go
+++ b/internal/container/manager.go
@@ -577,8 +577,13 @@ func (m *Manager) WriteVolumeBytes(ctx context.Context, workspace, filePath stri
    var buf bytes.Buffer
    tw := tar.NewWriter(&buf)

-   targetPath := path.Join("/vol", filePath)
-   targetPath = strings.TrimPrefix(targetPath, "/")
+   // Defense-in-depth: reject any filePath that escapes /vol after path.Join
+   // collapses "../" sequences (e.g. a traversal-laden upload filename).
+   cleaned := path.Join("/vol", filePath)
+   if cleaned != "/vol" && !strings.HasPrefix(cleaned, "/vol/") {
+       return fmt.Errorf("invalid file path %q: escapes volume root", filePath)
+   }
+   targetPath := strings.TrimPrefix(cleaned, "/")

    // Create parent directory entries with correct ownership
    parts := strings.Split(path.Dir(targetPath), "/")
diff --git a/internal/telegram/bot.go b/internal/telegram/bot.go
index 1234567..89abcdef 100644
--- a/internal/telegram/bot.go
+++ b/internal/telegram/bot.go
@@ -425,7 +425,7 @@ func (b *Bot) processMediaGroup(ctx context.Context, msgs []telego.Message) {
            slog.Error("file download failed", "file_id", att.FileID, "error", err)
            continue
        }
-       volumePath := fmt.Sprintf("uploads/%d_%s", time.Now().UnixNano(), att.Name)
+       volumePath := fmt.Sprintf("uploads/%d_%s", time.Now().UnixNano(), path.Base(att.Name))
        containerPath := "/workspace/agent/" + volumePath
        if err := b.orch.WriteVolumeBytes(ctx, ag.Workspace, volumePath, data, image); err != nil {
            slog.Error("file write to volume failed", "path", volumePath, "error", err)
@@ -565,7 +565,7 @@ func (b *Bot) processMessage(ctx context.Context, msg telego.Message) {
            }

            image := b.registry.ResolveImage(agentID)
-           volumePath := fmt.Sprintf("uploads/%d_%s", time.Now().Unix(), attachment.Name)
+           volumePath := fmt.Sprintf("uploads/%d_%s", time.Now().Unix(), path.Base(attachment.Name))
            containerPath := "/workspace/agent/" + volumePath

            if err := b.orch.WriteVolumeBytes(ctx, ag.Workspace, volumePath, data, image); err != nil {

Exploit Details

• GitHub Advisory: Official vendor advisory detailing the path traversal mechanism and stored instruction injection via ../../../CLAUDE.md.

Mitigation Strategies

• Upgrade Praktor to version 0.9.1 or later to enforce filename sanitization and volume root boundary checks.
• Configure explicit Telegram sender allowlists using the allow_from setting to block unauthenticated users from interacting with the bot.
• Audit existing persistent agent workspace volumes (praktor-wk-*) for unauthorized modifications to CLAUDE.md, skills, or hook files.
• Restrict agent tool permissions and MCP server access to minimize the post-exploitation impact of prompt or instruction injection.

Remediation Steps:

1. Stop the running Praktor orchestrator service.
2. Update the Praktor binary or container image to release v0.9.1 (or build from commit c3731eeda01c0b3ec1dbd13cccd5a147c3182141).
3. Edit the Praktor configuration file to specify trusted Telegram user IDs under the telegram.allow_from array rather than leaving it empty.
4. Inspect the root directory of all persistent agent Docker volumes (/workspace/agent) to verify that CLAUDE.md and hidden configuration directories have not been tampered with.
5. Restart the Praktor service and verify that file uploads are strictly written inside /workspace/agent/uploads/.

References

• GitHub Security Advisory GHSA-48v2-6jcm-fc99
• Official Fix Commit (c3731eeda01c0b3ec1dbd13cccd5a147c3182141)
• Praktor Pull Request #228
• Praktor Release v0.9.1
• NVD - CVE-2026-62331
• CVE.org Record - CVE-2026-62331
• CVEListV5 Repository Record

Read the full report for CVE-2026-62331 on our website for more details including interactive diagrams and full exploit analysis.