{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/instruction-injection/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mtzanidakis:praktor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-62331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["praktor (\u003c= 0.9.0)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","instruction-injection","agent-security","vulnerability"],"_cs_type":"advisory","_cs_vendors":["mtzanidakis"],"content_html":"\u003cp\u003eThe praktor agent platform is susceptible to a path traversal vulnerability (CVE-2026-62331) in its Telegram bot implementation. An attacker can supply a specially crafted filename containing directory traversal sequences (e.g., '../') during a file upload via Telegram. Because the platform fails to sanitize these filenames before writing them to the persistent agent workspace volume, an attacker can write files outside the intended 'uploads/' directory. This allows for the overwriting or creation of critical agent files, such as instructions, hooks, or configuration files, leading to stored instruction injection within the AI agent's environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote, unauthenticated Telegram user to write arbitrary files to the agent's persistent workspace volume. This can lead to the manipulation of agent behavior, configuration, or logic, as the AI agent consumes these files during subsequent execution runs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the praktor installation to version 0.9.1 or later to incorporate the fix implemented in PR #228.\u003c/li\u003e\n\u003cli\u003eImplement access control by restricting the \u003ccode\u003etelegram.allow_from\u003c/code\u003e configuration setting to trusted Telegram user IDs.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003e/workspace/agent\u003c/code\u003e directory for unexpected files or modifications if the instance was potentially exposed to unauthorized Telegram users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T04:13:34Z","date_published":"2026-11-04T04:13:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-praktor-path-traversal/","summary":"The praktor agent platform allows unauthenticated Telegram users to perform path traversal and stored instruction injection by uploading files with malicious filenames, enabling arbitrary file write access to the agent workspace.","title":"praktor: Path traversal and stored instruction injection (CVE-2026-62331)","url":"https://feed.craftedsignal.io/briefs/2026-11-praktor-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Instruction-Injection","version":"https://jsonfeed.org/version/1.1"}