Praktor (<= 0.9.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/praktor--0.9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 04:13:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpraktor: Path traversal and stored instruction injection (CVE-2026-62331)https://feed.craftedsignal.io/briefs/2026-11-praktor-path-traversal/Wed, 04 Nov 2026 04:13:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-praktor-path-traversal/The praktor agent platform allows unauthenticated Telegram users to perform path traversal and stored instruction injection by uploading files with malicious filenames, enabling arbitrary file write access to the agent workspace.The praktor agent platform is susceptible to a path traversal vulnerability (CVE-2026-62331) in its Telegram bot implementation. An attacker can supply a specially crafted filename containing directory traversal sequences (e.g., '../') during a file upload via Telegram. Because the platform fails to sanitize these filenames before writing them to the persistent agent workspace volume, an attacker can write files outside the intended 'uploads/' directory. This allows for the overwriting or creation of critical agent files, such as instructions, hooks, or configuration files, leading to stored instruction injection within the AI agent's environment.

Impact

Successful exploitation allows a remote, unauthenticated Telegram user to write arbitrary files to the agent's persistent workspace volume. This can lead to the manipulation of agent behavior, configuration, or logic, as the AI agent consumes these files during subsequent execution runs.

Recommendation

  • Upgrade the praktor installation to version 0.9.1 or later to incorporate the fix implemented in PR #228.
  • Implement access control by restricting the telegram.allow_from configuration setting to trusted Telegram user IDs.
  • Audit the /workspace/agent directory for unexpected files or modifications if the instance was potentially exposed to unauthorized Telegram users.
]]>highadvisorypath-traversalinstruction-injectionagent-securityvulnerability