Telegram Desktop vulnerability allowed any user's file to be stolen

What it is

A two-defect chain in Telegram Desktop that turns one clicked link into arbitrary file read and, from there, takeover of the victim's account. Fixed in 7.2.9. The fix shipped quietly: the changelog mentions only a rendering fix, the closing commit (db3405699f, 16 September 2026) is titled "Remove legacy interpret path helper", and no advisory was issued. Anyone tracking security advisories would not have seen it.

How it works

1. Separator injection. A second Telegram process launched by a tg:// link forwards the URL to the running instance over a local socket. Each record is KEYWORD:argument;, and the semicolon is never escaped. A semicolon inside the link therefore becomes extra records on the receiving side. Of the four record types, CMD: and CTRL: are harmless, but OPEN: accepts any URL with no scheme filter.
2. Missing authorization. Through OPEN: the attacker reaches the internal interpret: scheme (Support::InterpretSendPath). It was built for release scripts: it reads a file named in an instruction file and sends it to a channel or supergroup, with no confirmation and no check on who asked. The optional from: account check is skipped if the line is omitted.
3. Planting instruction files. Default auto-download saves files up to 8 MiB received in groups to the Downloads folder under the sender's chosen filename. Relative paths resolve from Telegram's data folder, so the attacker can reach Downloads without knowing the Windows user name.
4. Takeover. One file is sent per invocation, so the attacker posts three instruction files and stacks three interpret: commands in one link. The targets are tdata/key_datas, the session file in tdata/D877F783D5D3EF8C* (the folder name is the same on every install), and its maps index. With no local passcode, the KEK is derived from an empty password and a salt stored in the clear in key_datas, so the DEK and the session can be recovered. Dropping the three files into a fresh tdata opens the account.
5. Delivery. tg:// links clicked inside Telegram are handled in-process and never reach the socket. The attacker therefore sends an https link that redirects to the crafted tg:// link, and the system browser launches it.

flowchart TD
    A[Attacker adds victim to supergroup] --> B[Auto-download saves 3 instruction files]
    B --> C[Victim clicks https link]
    C --> D[Redirect to tg:// with semicolons]
    D --> E[Socket splits into 3 OPEN interpret: records]
    E --> F[Files sent to attacker's group]
    F --> G{Local passcode set?}
    G -- No --> H[Empty-password KEK: account taken over]
    G -- Yes --> I[Session files stolen but unusable]

Preconditions / Affected

• Telegram Desktop older than 7.2.9. The page does not state the earliest affected version.
• The victim can be added to a group without confirmation (the default privacy setting) and has auto-download on (the default).
• The victim clicks a link from outside Telegram. The browser may ask for confirmation before launching Telegram.
• Full account takeover additionally needs no local passcode, which is the default.
• The same primitive reads any file, such as SSH keys, browser password stores or cloud credentials.

What to do

• Upgrade to 7.2.9 or later. The page says this is the only thing that actually closes the problem.
• Turn on "ask where to save each file". This stops auto-download, so the instruction file never reaches disk. It is the most effective mitigation short of upgrading.
• Restrict who can add you to groups to contacts only. Stolen files can only go to a channel or supergroup, so this removes the attacker's delivery point.
• Set a local passcode and choose it like a real password. This does not stop the theft, but it makes the stolen session unusable.

Caveats

• Because the fix was unannounced, don't treat the absence of an advisory as a sign you are unaffected. Check the installed version.
• The fix also adds two hardening measures. CMD: and CTRL: records are skipped when the same connection carries an OPEN:. Local file paths are dropped once a non-local URL has appeared on that connection.
• Formats that Telegram saves to its internal cache (stickers, GIFs, voice messages) cannot be used to plant the file.
• A filename collision makes Telegram save the file as instructions1 (2).txt, which changes the path.
• The instruction file must be plain text with LF line endings and no byte-order mark.