https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 07:27:50 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-62331 <p>praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.</p> <p>praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-62331 https://db.gcve.eu/vuln/ghsa-48v2-6jcm-fc99 <p><strong>Affected:</strong> Go: github.com/mtzanidakis/praktor</p> <p>### Impact</p> <p>A remote Telegram user can write files to arbitrary paths inside an agent&#39;s persistent workspace volume (`praktor-wk-&lt;workspace&gt;`, mounted at `/workspace/agent`), escaping the documented `uploads/` directory.</p> <p>The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization (`internal/telegram/bot.go`, at both upload sites) and resolved with `path.Join`, which collapses `../` sequences. A filename like `../../../CLAUDE.md` resolved to the root of the agent workspace volume, outside `uploads/`.</p> <p>Because the agent workspace is the persistent working directory the Claude agent reads from and operates on across runs, writing outside `uploads/` lets an attacker plant or overwrite files the agent later consumes — e.g. `CLAUDE.md`, agent instruction/skill/hook files, or other config under `/workspace/agent`. This turns a file upload into a stored injection into the agent&#39;s instruction/execution surface (CWE-22 path traversal escalating to stored instruction injection).</p> <p>### Reachability</p> <p>By default the bot has no user allowlist (`allow_from: []` means &#34;allow all&#34;), so the only precondition is that a user can message the bot. No authentication or prior privilege is required.</p> <p>### Affected versions</p> <p>Through `v0.9.0` (and HEAD `3902d29`).</p> <p>### Patched versions</p> <p>`v0.9.1`, containing PR #228.</p> <p>### Workarounds</p> <p>Restrict `telegram.allow_from` to trusted user IDs to limit who can send uploads to the bot. Upgrading to `v…</p> <p><strong>Affected:</strong> Go: github.com/mtzanidakis/praktor</p> <p>### Impact</p> <p>A remote Telegram user can write files to arbitrary paths inside an agent&#39;s persistent workspace volume (`praktor-wk-&lt;workspace&gt;`, mounted at `/workspace/agent`), escaping the documented `uploads/` directory.</p> <p>The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization (`internal/telegram/bot.go`, at both upload sites) and resolved with `path.Join`, which collapses `../` sequences. A filename like `../../../CLAUDE.md` resolved to the root of the agent workspace volume, outside `uploads/`.</p> <p>Because the agent workspace is the persistent working directory the Claude agent reads from and operates on across runs, writing outside `uploads/` lets an attacker plant or overwrite files the agent later consumes — e.g. `CLAUDE.md`, agent instruction/skill/hook files, or other config under `/workspace/agent`. This turns a file upload into a stored injection into the agent&#39;s instruction/execution surface (CWE-22 path traversal escalating to stored instruction injection).</p> <p>### Reachability</p> <p>By default the bot has no user allowlist (`allow_from: []` means &#34;allow all&#34;), so the only precondition is that a user can message the bot. No authentication or prior privilege is required.</p> <p>### Affected versions</p> <p>Through `v0.9.0` (and HEAD `3902d29`).</p> <p>### Patched versions</p> <p>`v0.9.1`, containing PR #228.</p> <p>### Workarounds</p> <p>Restrict `telegram.allow_from` to trusted user IDs to limit who can send uploads to the bot. Upgrading to `v…</p> https://db.gcve.eu/vuln/ghsa-48v2-6jcm-fc99