CVE-2026-62331highPrompt injection2026-10-30

CVE-2026-62331: anyone who can message a praktor Telegram bot can overwrite CLAUDE.md and other agent instructions, upgrade to 0.9.1

praktor, a multi-agent Claude Code orchestrator driven from Telegram, puts the uploaded document's filename straight into the save path before 0.9.1. A Telegram user can use ../ in a filename to write anywhere in the persistent agent workspace, planting or replacing CLAUDE.md, skills, hooks or config that the Claude agent follows on later runs. With the default allow_from: [] anyone can message the bot.

01.

What it is

Both Telegram upload handlers in internal/telegram/bot.go join the attacker-controlled filename into the destination path without sanitizing it, and path.Join resolves the ../ traversal (CWE-22).

The write lands outside uploads/ but inside the persistent agent workspace mounted at /workspace/agent, not anywhere on the host.

An attacker can plant or overwrite CLAUDE.md, instruction, skill, hook or configuration files, turning a file upload into stored instruction injection for later agent runs.

Because allow_from: [] allows every sender by default, no authentication is needed in that configuration.

02.

How to check

Check your praktor version (anything before 0.9.1 is affected).
Check allow_from in your praktor config. An empty list means anyone on Telegram can reach the bot.
Review CLAUDE.md, skills, hooks and config files in the agent workspace for changes you didn't make.

03.

How to fix

Upgrade praktor to 0.9.1 or later.
Set allow_from to only your own Telegram user ids.
Restore any instruction or hook files that were changed, and treat secrets the agent could reach as exposed if you find tampering.

04.

Sources

More advisories for this tool