GoKawiilTelegram Desktop flaw let a single link steal any local file, including login sessions
A security researcher found that Telegram Desktop's local inter-process communication, used to hand clicked links to an already-running instance, fails to escape its command separator character. This let a maliciously crafted tg:// link be split into multiple injected commands, one of which could trigger an internal scheme that reads a named file and sends it to a chat without asking the user for confirmation. The flaw, tracked as CVE-2026-107181 and rated 8.1/High, was confirmed on Windows up to version 6.9.3 and fixed in Telegram Desktop 7.2.9.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit chain only requires a victim to click a link, it lowers the bar from typical file-theft attacks that need malware execution or social engineering beyond a single click. Exfiltrating session files specifically could let an attacker hijack a Telegram account outright rather than just read documents, which the researcher demonstrates in the full write-up. The case underscores how desktop apps' custom URI-handling and local IPC channels can become a quiet attack surface if input isn't sanitized.
- A single crafted tg:// link could exfiltrate arbitrary local files via unescaped IPC command injection in Telegram Desktop.
- The bug, CVE-2026-107181 (CVSS 8.1), was confirmed on Windows versions through 6.9.3 and patched in version 7.2.9.
- Stolen session files could enable full account takeover, not just generic file theft.
YubiKey 5C NFC — With exploits like this Telegram IPC flaw showing how easily session data and credentials can be stolen, adding hardware-based two-factor authentication is a smart move. A YubiKey 5C NFC lets you lock down your accounts so that even if an attacker grabs session files, they can't fully take over your login without the physical key in hand.
See YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: beaksec.github.io, 2026-10-10
Published there as: “Telegram Desktop vulnerability allowed any user's file to be stolen”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.