CVE-2026-107181: 
Telegram Desktop vulnerability analysis and mitigation

CVE-2026-107181 is an IPC record-separator injection vulnerability in Telegram Desktop's Core::Sandbox component that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. By reaching the interpret: scheme handler, attackers can coerce the application to upload local files — including tdata session keys — to an attacker-controlled Telegram channel, enabling full account takeover. All Telegram Desktop versions before 7.2.9 are affected. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is CWE-143 (Improper Neutralization of Record Delimiters). In Core::Sandbox::readClients() (sandbox.cpp, lines 362–364 of v7.2.8), URL strings passed via the IPC local socket were concatenated into a semicolon-delimited command stream without escaping semicolons present in the URL itself. A second Telegram Desktop instance sends OPEN:<url>; records to the primary instance; because the URL was not escaped, a crafted tg:// link such as tg://x?a=1;OPEN:interpret:<path> could inject additional OPEN:interpret: records into the stream. The interpret: scheme handler (support_helper.cpp, InterpretSendPath) reads a local instruction file specifying a target channel and file paths, then uploads those files — including session key artifacts in tdata/ — to the specified channel. The fix in v7.2.9 (commit db34056) introduces EscapeTo7bit/EscapeFrom7bit encoding for URLs in the IPC stream, adds an externalUrlReceived guard to drop local file paths when a non-file URL is present in the same connection, and removes the legacy interpret: path handler entirely (tdesktop commit, sandbox.cpp v7.2.8).

Successful exploitation allows an unauthenticated remote attacker to exfiltrate Telegram Desktop session key files (tdata/key_datas, D877F783D5D3EF8C, and maps files) from the victim's local filesystem to an attacker-controlled Telegram channel, enabling complete account takeover without requiring the victim's credentials or 2FA codes. Confidentiality and integrity are both severely impacted — the attacker gains persistent access to the victim's Telegram account and all its messages, contacts, and linked services. Availability is not directly affected. Because Telegram accounts are frequently used for two-factor authentication and sensitive communications, account compromise can facilitate further lateral movement into other services (GitHub Advisory, VulnCheck Advisory).

A public proof-of-concept exploit kit is available on GitHub (SeanDishman/telegram-cve-2026-107181), consisting of Python scripts (server.py, exploit.py, discord_exfil.py) that automate the full attack chain from payload generation through session file exfiltration to a Discord webhook. A second PoC repository (00nx/telegram-account-takeover-poc) also appeared shortly after. Exploitation requires user interaction — the victim must click a crafted tg:// link or visit a lure web page — but no authentication or privileges are required from the attacker. The EPSS score is approximately 0.345%, and as of the available data there is no confirmed in-the-wild exploitation or CISA KEV catalog listing. Nessus detection plugin 364268 is available (PoC GitHub, Feedly, Tenable).

1. Setup attacker infrastructure: Configure a Telegram channel ID and a Discord webhook URL. Run python exploit.py --watch to generate instruction files specifying the target channel and the session file paths (tdata/key_datas, D877F783D5D3EF8C, map files), and build the malicious tg:// URI of the form tg://x?a=1;OPEN:interpret:<rel_path> where <rel_path> traverses from the Downloads directory to the Telegram Desktop tdata folder.
2. Host the lure page: Run python server.py --channel <id> to serve an HTML lure page that executes location.replace(tg_url) on load, and a /r endpoint that issues a 302 redirect to the crafted tg:// URI.
3. Deliver the payload to the victim: Send the lure URL to the victim via any channel (email, social media, another messaging platform). The victim must click the link and have Telegram Desktop (version < 7.2.9) running.
4. Trigger IPC injection: The victim's browser opens the tg:// URI and hands it to Telegram Desktop. The second instance sends the crafted OPEN: command stream — including the injected OPEN:interpret:<path> record — to the primary instance via the local IPC socket. Because semicolons in the URL are not escaped in vulnerable versions, the injected record is parsed as a legitimate command.
5. Interpret handler uploads session files: The primary Telegram Desktop instance processes the interpret: record, reads the attacker-crafted instruction file from the Downloads directory, and uploads the specified tdata session key files to the attacker's Telegram channel.
6. Exfiltrate loot: discord_exfil.py polls the local filesystem for matching session artifacts and POSTs them as multipart form data to the attacker's Discord webhook, completing the account takeover (PoC GitHub, tdesktop commit).

• Network: Outbound HTTP POST requests from the victim host to Discord webhook URLs (discord.com/api/webhooks/...) containing multipart file data; unexpected outbound connections from Telegram Desktop to attacker-controlled Telegram channels shortly after a tg:// link is opened.
• File System: Presence of attacker-crafted instruction files in the user's Downloads directory (e.g., files containing lines like channel: <id>, file: tdata/..., caption: ...); unexpected access timestamps on tdata/key_datas, tdata/D877F783D5D3EF8C, or tdata/maps files.
• Logs: Browser history or OS URI handler logs showing tg://x?...;OPEN:interpret:... URIs with semicolons and path traversal sequences (../../../); Telegram Desktop debug logs (log.txt) showing Sandbox Warning: local file dropped messages (in patched versions) or unexpected interpret: path processing.
• Process: Telegram Desktop spawning file-read operations against tdata/ subdirectories immediately after handling a tg:// URI; Python processes (server.py, exploit.py, discord_exfil.py) running on an attacker host polling for session file artifacts (PoC GitHub, tdesktop commit).

The primary remediation is to update Telegram Desktop to version 7.2.9 or later, which removes the interpret: scheme handler entirely and introduces proper EscapeTo7bit encoding for URLs passed through the IPC socket, preventing semicolon injection (tdesktop v7.2.9 release, tdesktop commit). As a workaround prior to patching, users should avoid clicking tg:// links from untrusted sources and exercise caution with links received via email, web pages, or other messaging platforms. Organizations may consider restricting custom URI protocol handler registration (tg://) via group policy or endpoint security controls where operationally feasible (GitHub Advisory).

The vulnerability received notable coverage across security media and social platforms following the publication of the PoC. Security Online, CyberSecurityNews, and The Daily Tech Feed published articles describing it as a "one-click account takeover" flaw. Researchers on X (formerly Twitter) including @IntCyberDigest and @DarkWebInformer highlighted the issue, and it was discussed on Mastodon's infosec.exchange community. Developer-focused write-ups appeared on dev.to describing the semicolon injection mechanism in accessible terms. The vulnerability was also covered by Secure Bulletin, Hacking Passion, and State of Surveillance, reflecting broad community interest given Telegram's large user base and the severity of account takeover as an outcome (SecurityOnline, CyberSecurityNews, dev.to).