HighPublic exploitVulnerability

CVE-2026-107181

Telegram Desktop IPC Record Injection and Local File Exfiltration

Published Oct 7, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

44 mentions · peak 14 in a dayToday

CVSS8.6High · v4

EPSS0.34%27th percentile

CISA KEVNoNot listed

In the wildPoCPublic exploit

Vendor: Telegram

IdentifiersCVE-2026-107181CWE-143 · Improper Neutralization of Record…

CVE-2026-107181 is an IPC record-delimiter injection vulnerability in Core::Sandbox in Telegram Desktop before version 7.2.9. When a secondary application instance forwards an externally opened Telegram link to an already-running instance, semicolons within the URL are not escaped before serialization into semicolon-delimited IPC records. An attacker can inject additional OPEN records that invoke the internal interpret scheme. Its legacy Support::InterpretSendPath helper processes local instruction files and uploads specified files to a Telegram channel or supergroup without adequate caller authorization or user confirmation. The resulting chain enables arbitrary local-file exfiltration and, when usable session authorization material is stolen, account takeover. Exploitation was demonstrated on Windows with version 6.9.3; applicability to macOS and Linux was not demonstrated.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation compromises the confidentiality of files readable by the Telegram Desktop process, potentially exposing personal documents, private keys, credential stores, cloud credentials, and session authorization material. If no local Telegram Desktop passcode is configured, stolen session material can be decrypted and reused to access the victim's existing account without a new password or two-factor authentication challenge. Account takeover enables impersonation, sending messages, and manipulating the account. A local passcode protects session material but does not prevent arbitrary file theft. No availability impact is established.

Mitigation

If you can’t patch tonight, do this now.

Until patched, disable automatic group-file downloads or enable the option to ask where to save each file, disrupting predictable placement of the instruction files used by the demonstrated attack. Restrict group invitations to contacts and reject unexpected browser prompts to launch Telegram. Configure a strong local Telegram Desktop passcode to impede reuse of stolen session material; this does not prevent file exfiltration. Monitor external-link launches containing IPC separators or references to the internal interpret scheme, and correlate link processing with unusual session-data reads or uploads. Destination-based filtering for non-Telegram traffic alone will not detect exfiltration through Telegram infrastructure.

Remediation

Patch, then assume compromise.

Upgrade Telegram Desktop to version 7.2.9 or later. Version 7.2.9, released September 17, 2026, removes the internal interpret scheme and Support::InterpretSendPath helper, escapes IPC record values before transmission, and decodes them only after record splitting. The fix also hardens handling of mixed command types and local paths accompanying external URLs. Clients derived from affected Telegram Desktop code must incorporate equivalent fixes. If compromise is suspected, terminate other active Telegram sessions and review chats for unexpected file uploads.

Public exploits

Exploits

3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.

View more in app →

telegram-cve-2026-107181The supplied repository contains nine files: four Python scripts, one static HTML page, documentation, environment and ignore templates, and an nginx configuration example. exploit.py is the main builder: it normalizes channel IDs, creates three randomly named instruction attachments, writes a browser lure and raw payload, and optionally starts an HTTP server and Discord forwarding thread. server.py provides equivalent lure hosting with HTML, redirect, and plaintext-payload routes. poc.py is an alias for exploit.py. discord_exfil.py supports explicit file uploads or polling local directories, deduplicating matching loot by SHA-256 and forwarding it to a runtime-configured webhook. The checked-in index.html is harmless static content; the generated out/index.html contains the actual redirect. The proposed exploit chains unescaped semicolon delimiters in Telegram's single-instance IPC with an internal interpret: instruction handler. Its intended impact is local session-file disclosure and potential account-session compromise, not shell execution. Attachment delivery, victim interaction, chat permissions, and operator-side acquisition of uploaded files are external prerequisites; the scripts do not automate those steps. Default theft targets are fixed in the Python source, while channel, lure hosting, and instruction-location settings are configurable. The code is consistent with an operational exploit kit rather than a detection script, and no unrelated destructive commands or hardcoded live webhook were found. However, the supplied material includes no vulnerable Telegram source, execution results, or independent advisory verification. The CVE assignment, affected versions, claimed successful tests, and fix in 7.2.9 remain repository assertions. No repository URL, git reference, or archive size was supplied; those metadata fields are left empty or use a zero placeholder. The listed individual file sizes total 21,188 bytes, which is not an archive-size measurement.SeanDishman · Disclosed Oct 10, 2026 · python · javascript · browser · web · fileOperational telegram-account-takeover-pocThe supplied repository contains 13 files, including eight JavaScript source files, package metadata, configuration examples, documentation, and an MIT license. It is a standalone Node.js application, not an identified exploit-framework module. server.js starts the Express application; src/server.js implements the redirect lure, raw payload display, and file collection routes. src/payload.js builds semicolon-separated OPEN:interpret commands, while src/instructions.js generates upload instructions targeting three Telegram session artifacts. bin/craft.js prints the crafted URI, scripts/generate-instructions.js writes instructions and optionally copies them into the executing user's Downloads directory, src/config.js loads environment configuration, and src/bot.js optionally retrieves Telegram document attachments into loot. The implemented capability is attempted IPC injection leading to local-file exfiltration, not demonstrated operating-system RCE. The repository claims CVE-2026-107181, affected versions through 7.2.8, and a fix in 7.2.9; these claims are not independently established by the supplied code. There is no evidence of an unrelated destructive payload or an obviously fake exploit. Successful execution nevertheless depends on vulnerable client behavior, correct path resolution, accessible instruction files, user interaction, and destination permissions. The repository does not implement remote placement of instruction files: --deploy only copies them on the machine running the generator. It also contains no automated account-takeover implementation. Operational limitations include a bot collector that reads update.message.document but ignores channel_post documents, and an instruction generator whose default filenames remain hardcoded despite the configurable INSTRUCTION_FILES setting. The server exposes collected data and accepts uploads without authentication; app.listen does not explicitly bind to loopback. Documentation mentions tests, samples, and a health endpoint, but no test or sample files appear in the supplied inventory and no dedicated health route is implemented. Generated output and loot directories are not explicitly ignored in the supplied .gitignore. No real bot token, destination identifier, or attacker IP is supplied. The repository URL is inferred from the README; the analyzed Git reference and archive size were not provided. The listed file sizes total 24,279 bytes, which is not an archive-size measurement.00nx · Disclosed Oct 13, 2026 · javascript · web · local · fileOperational cve-2026-107181-pocThe supplied repository contains one standalone Python exploit, a README, a dependency declaration, and a .gitignore. exploit.py uses only the standard library, creates three ASCII/LF instruction files, and runs a threaded HTTP server. Its /go route redirects browsers to a tg:// URI containing semicolon-separated OPEN:interpret: records. The intended chain is browser-triggered IPC record injection, interpretation of attacker-delivered files, and upload of three hardcoded Telegram session files to an operator-selected supergroup. Other HTTP paths display a benign-looking decoy page. Delivery of the instruction documents and subsequent session reconstruction are manual; the script contains no vulnerability probe, shell payload, or automated account-login logic. The README claims CVE-2026-107181 affects Telegram Desktop <= 7.2.8 and is fixed in 7.2.9, but neither the advisory, patch, nor exploit effectiveness was independently verified. There are no obvious unrelated destructive operations or evidence of a fake exploit in the supplied code. Documentation reference URLs are not contacted by the script. The listed files total 10,106 bytes; the original repository URL, git reference, archive location, and actual archive size were not supplied, so repository metadata uses empty or unknown placeholders.abdugafforov-bobur · Disclosed Oct 14, 2026 · python · browser · network · localOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TelegramTelegram Desktopapplication

External references

References

MITRE CVEcve.org · CVE-2026-107181 NVDnvd.nist.gov/vuln/detail/CVE-2026-107181 MITRE CWE · CWE-143Improper Neutralization of Record Delimiters beaksec.github.iobeaksec.github.io/posts/telegram-desktop-one-click-account-takeover github.comgithub.com/telegramdesktop/tdesktop github.comgithub.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp github.comgithub.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp github.comgithub.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a github.comgithub.com/telegramdesktop/tdesktop/releases/tag/v7.2.9 vulncheck.comvulncheck.com/advisories/telegram-desktop-before-7.2.9-ipc-record-injection-file-exfiltration-via-interpret-scheme

Activity feed

Recent activity

44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

codebyNews · Oct 13, 2026CVE-2026-107181: one-click захват аккаунта в Telegram DesktopThe article describes a one-click account takeover vulnerability in Telegram Desktop before version 7.2.9, demonstrated on Windows. An unescaped delimiter in IPC messages allows an attacker-controlled tg:// link to inject commands and reach the internal interpret scheme, which lacks authorization checks. This enables arbitrary local file reading and upload to an attacker-controlled Telegram channel or supergroup without confirmation. Stolen tdata session material can enable account takeover. The article reports CVSS scores of 8.6 (v4.0) and 8.1 (v3.1), a public working proof of concept, and no observed exploitation in the wild. Version 7.2.9, released September 17, 2026, reportedly fixes the flaws.Read more ↗xakepNews · Oct 12, 2026В Telegram Desktop исправили критический баг, позволявший похищать файлы - ХакерTelegram Desktop incorrectly handled semicolon separators in tg:// links, allowing attackers to inject internal commands and invoke the privileged interpret: handler without authorization checks. The demonstrated attack used automatically downloaded instruction files and a malicious link to exfiltrate arbitrary accessible local files into an attacker-controlled Telegram group. Stealing Telegram tdata authorization files enabled restoration of the victim's session in another client and account hijacking. The article reports that Telegram Desktop 7.2.9, released September 17, 2026, fixed command-separator handling and removed interpret:, although its earlier affected-version wording ambiguously includes that same version.Read more ↗thecybersecguruNews · Oct 10, 2026Telegram CVE-2026-107181: One-Click Account Takeover | The CyberSec GuruAccording to the content, a Telegram Desktop vulnerability chains unescaped semicolon delimiters in single-instance IPC with an unauthorized legacy interpret: URI handler. A malicious link can trigger silent exfiltration of files accessible to Telegram. The demonstrated account-takeover chain relies on automatically downloaded instruction files and the absence of a local passcode, allowing stolen session data to be reused without a new authentication challenge. The reported CVSS v3.1 score is 8.1 (High). Telegram Desktop 7.2.9, released September 17, 2026, fixes the issue. Defense-in-depth measures include setting a local passcode, disabling group auto-downloads, and restricting who can add users to groups.Read more ↗cryptika blogNews · Oct 9, 2026PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover | Cryptika CybersecurityTelegram Desktop improperly escapes record delimiters in its local IPC channel when processing externally opened links. A crafted link can inject a command invoking a legacy helper that reads local files and uploads them to a chat without permission checks or confirmation. Stolen session data can enable account takeover if no local passcode is enabled. The public PoC demonstrated the attack on Windows; macOS and Linux were not demonstrated. The chain depends on automatic group file downloads and allowing anyone to add the victim to a group. Links opened inside Telegram are unaffected.Read more ↗

+8 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery observed campaign linking this CVE to a named adversary.

Associated malwareMalware families riding this exploit, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity32Community discussion across Reddit, Mastodon, and other social sources.