CVE-2026-62331 in Praktor
Summary
by MITRE • 10/30/2026
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of praktor prior to 0.9.1 represents a critical stored instruction injection flaw rooted in improper path canonicalization and insufficient input sanitization within the Telegram bot integration module. Specifically, the function responsible for handling document uploads located at internal/telegram/bot.go fails to validate or sanitize filenames provided by remote users before concatenating them into destination file paths. This implementation relies on Go's standard library path.Join function, which is known to collapse parent-directory traversal sequences such as ../ when joining paths under certain conditions if not handled with explicit security checks against absolute paths or traversals outside the intended base directory. Consequently, an attacker can craft a malicious filename containing directory traversal characters that bypasses the expected containment within the uploads/ subdirectory.
This technical flaw allows any remote Telegram user capable of messaging the bot to write arbitrary files into persistent agent workspace directories mounted at /workspace/agent. The severity of this vulnerability is significantly amplified by the default configuration settings, where allow_from is set to an empty slice or wildcard, effectively permitting all senders without requiring authentication or prior privilege escalation. This lack of access control means that any user interacting with the bot can exploit the path traversal issue to place files directly into areas monitored and utilized by the underlying Claude Code agent infrastructure.
The operational impact extends beyond simple file system manipulation because it enables stored instruction injection against the AI agent itself. By overwriting or planting specific configuration files such as CLAUDE.md, skill definitions, hook scripts, or other instructional metadata that the agent reads during its execution cycles, an attacker can permanently alter the behavior of the autonomous coding assistant. This transforms a simple document upload feature into a persistent vector for command injection and logic manipulation, allowing the adversary to dictate how the AI processes subsequent tasks, potentially leading to unauthorized code generation, data exfiltration via the agent's capabilities, or further compromise of systems accessible by the Claude Code environment.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection). In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques related to Stored Command Injection and potentially Initial Access via trusted software supply chain if the agent is used in automated pipelines. The attack vector leverages the trust relationship between the user input mechanism and the persistent storage layer of the application.
Mitigation for this issue involves upgrading to version 0.9.1 where the path handling logic has been corrected to properly sanitize inputs and prevent directory traversal. Additionally, organizations should enforce strict access controls by configuring allow_from to restrict bot interactions to known, trusted users rather than leaving it open to all senders. Implementing additional validation layers that reject filenames containing relative path components or absolute paths before any file system operations are performed is also recommended as a defense-in-depth measure. Regular auditing of agent configuration files and workspace permissions can further reduce the risk of stored instruction injection attacks in multi-agent orchestration environments.