{"id":"CVE-2026-62331","aliases":[],"cve":{"records":[{"id":"CVE-2026-62331","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-13T21:42:50.094Z","published":"2026-10-30T19:00:25.777Z","modified":"2026-10-30T19:46:25.082Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T19:00:25.777Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T19:46:25.082Z"}],"references":[{"url":"https://github.com/mtzanidakis/praktor/security/advisories/GHSA-48v2-6jcm-fc99","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/mtzanidakis/praktor/pull/228","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mtzanidakis/praktor/commit/c3731eeda01c0b3ec1dbd13cccd5a147c3182141","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mtzanidakis/praktor/releases/tag/v0.9.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T19:45:09.898798Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"praktor: Telegram upload traversal permits persistent agent instruction injection","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.","score":8.2,"severity":"high","published":"2026-10-30T19:00:25.777Z","modified":"2026-10-30T19:46:25.082Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mtzanidakis","name":"praktor","platforms":[],"versions":[{"version":"< 0.9.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-62331"}],"remediation":[],"references":["https://github.com/mtzanidakis/praktor/security/advisories/GHSA-48v2-6jcm-fc99","https://github.com/mtzanidakis/praktor/pull/228","https://github.com/mtzanidakis/praktor/commit/c3731eeda01c0b3ec1dbd13cccd5a147c3182141","https://github.com/mtzanidakis/praktor/releases/tag/v0.9.1"],"sources":[{"name":"CVE","id":"CVE-2026-62331","modified":"2026-10-30T19:46:25.082Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62331"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2}],"sourceAffected":[],"observedAt":"2026-10-30T20:13:58.614Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T20:15:35.508Z","attemptedAt":"2026-10-30T20:15:35.508Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T20:15:36.119Z","attemptedAt":"2026-10-30T20:15:36.119Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T20:15:34.249Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T20:15:35.071Z","attemptedAt":"2026-10-30T20:15:35.071Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-62331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62331","modified":"2026-10-30T19:39:14.897","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","checkedAt":"2026-10-30T20:15:35.508Z"}],"aiSummary":{"text":"Praktor versions prior to 0.9.1 have a path traversal vulnerability, allowing a remote Telegram user to write outside the intended directory, potentially injecting instructions. This issue affects the persistent agent workspace. No prior authentication is required by default.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:21:16.284Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62331"}]}}