If you use Telegram on a Windows PC, check your app version before you click anything else today. A vulnerability in Telegram Desktop, disclosed this month by security researcher BeakSec and tracked as CVE-2026-107181, allowed a crafted link to steal local files from a victim’s computer — including the session files that amount to a Telegram account takeover. The flaw is fixed in version 7.2.9, released on September 17, but it affects every version through 7.2.8, and the fix arrived quietly.
Two small defects, one dangerous chain
The attack combines two defects that would be far less serious apart, according to the researcher’s technical write-up, published on October 3. The first is an injection problem in how Telegram Desktop handles links. When the app is already running and a user clicks a Telegram link elsewhere — in a browser, for example — a second instance of the app passes that link to the running one over a local connection, flattened into text commands separated by semicolons. The app never escaped that separator character. A semicolon hidden inside a crafted link therefore stopped being part of the link and started being read as the beginning of a new command.
The second defect is what an injected command could reach: an internal feature, built years ago to help Telegram’s own developers publish release files to a channel, that reads an instruction file and then sends whatever file that instruction names to a chat. It asked for no confirmation and performed no check on who had invoked it. Reached through the injection, it turned a clicked link into a way to read arbitrary files off the victim’s disk and send them to an attacker-controlled group — silently.
From a group invite to a stolen session
The researcher’s proof of concept starts with a group invite, which Telegram’s default privacy settings allow from anyone. Files posted in groups are downloaded automatically by default, landing in a predictable folder on the victim’s machine. The attacker posts small instruction files there, then shares an ordinary-looking web link. When the victim clicks it — outside the app — the link redirects into the crafted Telegram link, the injected commands execute the instructions, and the targeted files are uploaded to the attacker’s group with no dialog shown.
The most valuable targets are Telegram’s own session files. Telegram encrypts its local data, but the encryption key is itself wrapped using a key derived from the user’s local passcode. Most users never set one — and with no passcode, that derivation starts from an empty password and a salt stored inside one of the very files being stolen, per the researcher’s analysis. An attacker holding the stolen files can reconstruct the session and open the account as the victim. The same primitive could just as easily aim at other files on the machine, from SSH keys to cloud credentials, the researcher notes.
The limits matter, too
This is a serious flaw — rated High, at 8.1 under CVSS 3.1 in the researcher’s assessment and 8.6 under CVSS 4.0 in the CVE record — but it is not magic. It was confirmed on Windows. It needs the victim to click a link from outside the Telegram app, because links clicked inside Telegram chats are handled by a different path that never reaches the vulnerable handoff. It depends on the app’s default settings for group adds and automatic downloads, and a local passcode, while it cannot stop files from being taken, makes a stolen session far harder to use. Threat-intel trackers had recorded no confirmed exploitation in the wild as of October 9.
A fix that shipped without a warning
The timeline adds an uncomfortable note. The researcher reported the issue through the Zero Day Initiative on June 25. Telegram fixed it independently on September 16 — removing the internal feature entirely and fixing the separator handling — and shipped the fix in version 7.2.9 the next day. But according to the researcher, that release’s changelog mentioned only a rendering fix, and no security advisory accompanied it, so users on older versions had no signal to update urgently. The CVE was assigned on October 7, after the write-up appeared, and coverage from Cybernews and other security outlets followed this week.
What to do now
- Update Telegram Desktop to version 7.2.9 or later. The researcher is explicit that upgrading is the only step that fully closes the hole.
- Turn on “ask where to save each file” in settings, so files from groups and channels are never downloaded automatically.
- Restrict group invites to your contacts, so strangers cannot add you to a group unasked.
- Set a local passcode — a real one, not a token gesture — so that stolen session files alone are not enough to open your account.
The broader pattern is familiar: an internal convenience, built for trusted hands, becomes attack surface the moment an outsider can reach it — the same failure shape lately seen in AI agents acting beyond their intended scope on live systems.
