4 matches found
CVE-2026-62331
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331
The praktor multi-agent Claude Code orchestrator (versions prior to 0.9.1 ) contains a path traversal vulnerability in the internal/telegram/bot.go file. The application fails to sanitize attacker-controlled document filenames during Telegram uploads, allowing path.Join to collapse parent-directo...
CVE-2026-62331 praktor: Telegram upload traversal permits persistent agent instruction injection
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331: mtzanidakis praktor: praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission…
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...