Telegram Desktop IPC Injection Enables One-Click File Read and Account Takeover
CVE-2026-107181 details an IPC command injection vulnerability in Telegram Desktop caused by unescaped delimiter characters during single-instance socket communication. Attackers can leverage crafted URIs to trigger an internal `interpret:` handler, reading arbitrary local files and exfiltrating session data without user confirmation.
IPC Serialization and Delimiter Injection
Telegram Desktop registers the `tg://` URI scheme with the host operating system. When a link is clicked, the OS launches a secondary client process. If a primary Telegram instance is already running, the secondary process detects the active server socket, serializes the incoming URL into text, and passes it over the IPC channel before exiting.
The single-instance serialization protocol uses a simple text format where instructions are delimited by semicolons. In `sandbox.cpp`, commands are constructed by concatenating the raw URL:
```cpp commands += u"OPEN:"_q + url.toString(QUrl::FullyEncoded) + ';'; ```
Because `QUrl::FullyEncoded` leaves semicolons intact within query strings, a URI containing a semicolon (such as `tg://x?a=1;OPEN:interpret:...`) breaks the serial frame structure. When the primary instance receives the payload, `sandbox.cpp` parses the string using `cmds.indexOf(QChar(';'))`. This splits the single stream into multiple instructions, executing injected IPC commands sequentially.
The Privilege Boundary in interpret: Handling
The injection primitive allows arbitrary invocation of `OPEN:`, which processes URIs without filtering scheme parameters. This exposes Telegram’s unregistered, internal `interpret:` scheme handled in `application.cpp`.
Originally designed for build release automation, `interpret:` delegates handling to `InterpretSendPath()` in `support_helper.cpp`. The handler parses an on-disk instruction file containing directive keys such as `channel:`, `file:`, `caption:`, and `from:`.
If the `from:` field is left out of the instruction file, Telegram skips account ID verification entirely. `InterpretSendPath()` reads the specified file off the filesystem and transmits it to the specified group or channel. The operation lacks authorization checks and executes without prompt or user confirmation.
Payload Staging and Path Traversal
Triggering the chain requires staging an instruction file at a predictable local file path. Under default configurations, Telegram Desktop automatically downloads group attachments up to 8 MiB without user intervention, placing them in `C:\Users\
To bypass dynamic Windows usernames, the `interpret:` scheme accepts relative paths resolved from Telegram's data directory (`%APPDATA%\Telegram Desktop`). An attacker can reference an automatically downloaded instruction file using path traversal:
```text interpret:../../../Downloads/Telegram%20Desktop/instructions.txt ```
Once executed, the instruction file can target sensitive files—including session credentials—and exfiltrate them directly to an attacker-controlled chat.
Patch Details and Affected Versions
The vulnerability affects Telegram Desktop versions up to 7.2.8 and carries a CVSS 3.1 score of 8.1 (CVE-2026-107181). Testing confirmed successful exploitation on Windows running version 6.9.3.
The flaw was mitigated in Telegram Desktop version 7.2.9 via commit `db3405699f`, which addresses the missing IPC serialization sanitization and prevents unauthenticated internal command execution.