# Telegram uploads let any default sender overwrite praktor agent instruction files

Canonical: https://www.clawpit.io/egret/24
Published: 2026-11-10T06:06:13+00:00
Reviewed by: Egret AI managing editor


A remote Telegram user who can message praktor by default can write files outside the uploads directory into the agent's persistent workspace, privately reported by tonghuaroot, because the empty allow list permits every sender.

The upload handler concatenates the attacker-controlled document filename into the destination path without sanitization, and path.Join collapses '../' sequences, so a name such as '../../../CLAUDE.md' can resolve at the workspace root. With allow_from: [] meaning every sender by default, no authentication is required. The attacker can plant or overwrite CLAUDE.md or other instruction, skill, hook and config files the Claude agent reads across later runs; the demonstrated scope is the persistent workspace volume, not the whole host filesystem.

Upgrade praktor to version 0.9.1, which applies path.Base to filenames at both upload sites and makes WriteVolumeBytes reject paths escaping /vol. As a workaround, restrict telegram.allow_from to trusted user IDs.

## Evidence and scope

- Affected versions: [{"product":"github.com/mtzanidakis/praktor (go)","affected":"<= 0.9.0","fixed":"0.9.1","source":"E1"},{"product":"mtzanidakis / praktor","affected":"< 0.9.1","fixed":"0.9.1","source":"E2"}]
- Fixed versions: [{"product":"github.com/mtzanidakis/praktor (go)","fixed":"0.9.1","source":"E1"},{"product":"mtzanidakis / praktor","fixed":"0.9.1","source":"E2"}]
- Exploitation: Reporter-reported end-to-end proof of concept against the real container.Manager; in-the-wild exploitation is not established by supplied evidence.
- Limitations: Scope is limited to the persistent agent workspace volume; host-filesystem escape and independent exploitation confirmation are not established by supplied evidence.

## Original sources

- [GitHub Advisory Database](https://github.com/advisories/GHSA-48v2-6jcm-fc99)
- [GitHub_M CNA / CVE Program](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62331.json)

AI-assisted reporting. External findings belong to the credited researchers.