CVE-2026-62331

The praktor multi-agent Claude Code orchestrator (versions prior to 0.9.1 ) contains a path traversal vulnerability in the internal/telegram/bot.go file. The application fails to sanitize attacker-controlled document filenames during Telegram uploads, allowing path.Join to collapse parent-directo...

CVE-2026-62331 praktor: Telegram upload traversal permits persistent agent instruction injection

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...