CVE-2026-107181

HighCVSS 8.1/10Last modified Nov 9, 2026

Description

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-143

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
TelegramTelegram Desktop< 7.2.9

References

Timeline

Published
Oct 7, 2026
Last modified
Nov 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071838.1llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated rCVE-2026-1071868.6An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workCVE-2026-1071878.5A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentCVE-2026-1071889.6A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the filCVE-2026-107191.8Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writinCVE-2026-1071936.5A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the CVE-2026-1071949.2Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentiallyCVE-2026-10724.3The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. ThCVE-2026-107205.1Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders ofCVE-2026-1072029.1A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listenCVE-2026-1072035.4An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interCVE-2026-1072049.8LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by