{
  "id": 18038246,
  "title": "CVE-2026-62331: CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads",
  "url": "https://urgent.news/2026/11/03/cve-2026-62331-cve-2026-62331-path-traversal-and-stored-instruction",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T23:31:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-62331-cve-2026-62331-path-traversal-and-stored-instruction-injection-in-praktor-telegram-95m"
  },
  "original_language": "en",
  "account": "CVE-2026-62331 describes a critical path traversal vulnerability in Praktor Telegram file uploads, affecting versions prior to 0.9.1. The issue arises from the lack of proper sanitization of user-controlled filenames during document uploads within the multi-agent Claude Code orchestrator. This allows an unauthenticated remote attacker to overwrite arbitrary files within the agent workspace volume, potentially leading to persistent prompt and instruction injection by modifying files like CLAUDE.md. The vulnerability exists due to improper sanitization of filenames during uploads, enabling path traversal to escape the designated uploads directory. To mitigate the issue, Praktor version 0.9.1 or later should be deployed to enforce filename sanitization and volume root boundary checks.",
  "summary": "CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads Vulnerability ID: CVE-2026-62331 CVSS Score: 8.2 Published: 2026-11-03 CVE-2026-62331 is a high-severity path traversal vulnerability (CWE-22) affecting Praktor versions prior to 0.9.1. Praktor is a multi-agent Claude Code orchestrator that integrates Telegram message handling with isolated Docker…",
  "key_points": [
    "Critical path traversal vulnerability in Praktor Telegram file uploads",
    "Lack of sanitization allows arbitrary file overwrites by attackers",
    "Deploy Praktor 0.9.1 or later to mitigate vulnerability"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}