praktor: Path traversal and stored instruction injection (CVE-2026-62331)

The praktor agent platform is susceptible to a path traversal vulnerability (CVE-2026-62331) in its Telegram bot implementation. An attacker can supply a specially crafted filename containing directory traversal sequences (e.g., '../') during a file upload via Telegram. Because the platform fails to sanitize these filenames before writing them to the persistent agent workspace volume, an attacker can write files outside the intended 'uploads/' directory. This allows for the overwriting or creation of critical agent files, such as instructions, hooks, or configuration files, leading to stored instruction injection within the AI agent's environment.

Impact

Successful exploitation allows a remote, unauthenticated Telegram user to write arbitrary files to the agent's persistent workspace volume. This can lead to the manipulation of agent behavior, configuration, or logic, as the AI agent consumes these files during subsequent execution runs.

Recommendation

• Upgrade the praktor installation to version 0.9.1 or later to incorporate the fix implemented in PR #228.
• Implement access control by restricting the telegram.allow_from configuration setting to trusted Telegram user IDs.
• Audit the /workspace/agent directory for unexpected files or modifications if the instance was potentially exposed to unauthorized Telegram users.