Summary
Praktor's Telegram upload handlers can use an attacker-controlled filename to construct a destination path without adequately preventing parent-directory traversal. A remote Telegram user who can message the bot may write or overwrite files in the persistent agent workspace, potentially causing stored instruction injection in later Claude agent runs.
Praktor's Telegram upload handlers can use an attacker-controlled filename to construct a destination path without adequately preventing parent-directory traversal. A remote Telegram user who can message the bot may write or overwrite files in the persistent agent workspace, potentially causing stored instruction injection in later Claude agent runs.
Affected context
The issue occurs in Praktor deployments where Telegram document uploads are handled by the affected upload paths and filenames are incorporated into destination paths without sufficient sanitization. It is especially risky when the bot accepts messages from unrestricted senders and the persistent /workspace/agent volume contains files that influence Claude agent behavior, such as instructions, skills, hooks, or configuration.
The issue occurs in Praktor deployments where Telegram document uploads are handled by the affected upload paths and filenames are incorporated into destination paths without sufficient sanitization. It is especially risky when the bot accepts messages from unrestricted senders and the persistent /workspace/agent volume contains files that influence Claude agent behavior, such as instructions, skills, hooks, or configuration.
Exploit preconditions
- Attack surface: Telegram document upload handling
- Required access: Ability to send a message or document to the Praktor bot; authentication may not be required when sender restrictions are left open
- Trigger point: Processing and storing an uploaded document using its supplied filename
- Why exploitation is possible: Path construction permits parent-directory traversal, allowing the resulting destination to escape the intended
uploads/directory while remaining within the mounted agent workspace
- Attack surface: Telegram document upload handling
- Required access: Ability to send a message or document to the Praktor bot; authentication may not be required when sender restrictions are left open
- Trigger point: Processing and storing an uploaded document using its supplied filename
- Why exploitation is possible: Path construction permits parent-directory traversal, allowing the resulting destination to escape the intended
uploads/directory while remaining within the mounted agent workspace
Why this happens
The vulnerable upload handlers concatenate attacker-controlled filenames into filesystem paths and rely on path.Join without first enforcing a trusted destination boundary. Because path normalization can resolve parent-directory components, an uploaded name can reference files outside the intended directory. This is a path traversal flaw mapped to CWE-22, and its effect is amplified when written files are later trusted as agent instructions or operational configuration.
The vulnerable upload handlers concatenate attacker-controlled filenames into filesystem paths and rely on path.Join without first enforcing a trusted destination boundary. Because path normalization can resolve parent-directory components, an uploaded name can reference files outside the intended directory. This is a path traversal flaw mapped to CWE-22, and its effect is amplified when written files are later trusted as agent instructions or operational configuration.
Potential impact
- An attacker may create or overwrite files in the persistent agent workspace
- Later agent runs could consume attacker-controlled instructions or configuration
- The Claude agent may perform unintended actions based on planted files
- Hooks, skills, or other workspace behavior may be altered
- Data integrity and workflow reliability could be compromised
- The issue could support persistence across subsequent agent runs
- An attacker may create or overwrite files in the persistent agent workspace
- Later agent runs could consume attacker-controlled instructions or configuration
- The Claude agent may perform unintended actions based on planted files
- Hooks, skills, or other workspace behavior may be altered
- Data integrity and workflow reliability could be compromised
- The issue could support persistence across subsequent agent runs
General mitigation guidance
Mitigation generally focuses on treating upload filenames as untrusted metadata and enforcing a strict destination boundary.
Common defensive patterns include:
- Discarding user-supplied path components and generating server-side storage names
- Canonicalizing the candidate path and verifying that it remains beneath the intended upload directory
- Rejecting absolute paths, traversal components, and platform-specific separator variants
- Separating uploaded content from instruction, hook, skill, and configuration locations
- Restricting which files the agent can read or execute from persistent workspace storage
- Requiring explicit sender authorization rather than permitting all Telegram users by default
- Applying least privilege to the bot process and workspace volume
- Using isolated, non-persistent storage when persistence is not necessary
Mitigation generally focuses on treating upload filenames as untrusted metadata and enforcing a strict destination boundary.
Common defensive patterns include:
- Discarding user-supplied path components and generating server-side storage names
- Canonicalizing the candidate path and verifying that it remains beneath the intended upload directory
- Rejecting absolute paths, traversal components, and platform-specific separator variants
- Separating uploaded content from instruction, hook, skill, and configuration locations
- Restricting which files the agent can read or execute from persistent workspace storage
- Requiring explicit sender authorization rather than permitting all Telegram users by default
- Applying least privilege to the bot process and workspace volume
- Using isolated, non-persistent storage when persistence is not necessary
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying filesystem joins that incorporate request, message, or upload metadata
- Code review checks for direct use of filenames in storage paths
- Tests covering parent-directory components, absolute paths, alternate separators, and normalization behavior
- Runtime monitoring for writes outside the designated upload directory
- File-integrity monitoring for unexpected changes to agent instructions, hooks, skills, and configuration
- Policy enforcement requiring server-generated upload identifiers and sender allowlists
- Automated security review tools that flag path construction using untrusted input
Organizations can look for this class of issue through:
- Static analysis rules identifying filesystem joins that incorporate request, message, or upload metadata
- Code review checks for direct use of filenames in storage paths
- Tests covering parent-directory components, absolute paths, alternate separators, and normalization behavior
- Runtime monitoring for writes outside the designated upload directory
- File-integrity monitoring for unexpected changes to agent instructions, hooks, skills, and configuration
- Policy enforcement requiring server-generated upload identifiers and sender allowlists
- Automated security review tools that flag path construction using untrusted input
