CVE-2026-62331: CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads
CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads Vulnerability ID: CVE-2026-62331 CVSS Score: 8.2 Published: 2026-11-03 CVE-2026-62331 is a high-severity path traversal vulnerability (CWE-22) affecting Praktor versions prior to 0.9.1. Praktor is a multi-agent Claude Code orchestrator that integrates Telegram message handling with isolated Docker…
CVE-2026-62331 describes a critical path traversal vulnerability in Praktor Telegram file uploads, affecting versions prior to 0.9.1. The issue arises from the lack of proper sanitization of user-controlled filenames during document uploads within the multi-agent Claude Code orchestrator. This allows an unauthenticated remote attacker to overwrite arbitrary files within the agent workspace volume, potentially leading to persistent prompt and instruction injection by modifying files like CLAUDE.md.
The vulnerability exists due to improper sanitization of filenames during uploads, enabling path traversal to escape the designated uploads directory. To mitigate the issue, Praktor version 0.9.1 or later should be deployed to enforce filename sanitization and volume root boundary checks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
