praktor EUVD-2026-114361

No authentication is required in the default configuration because telegram.allow_from: [] is interpreted as allow-all, so the only precondition is that an attacker can message the bot and send a document; the attacker must control the document filename and embed ../ traversal sequences that path.Join collapses. Exploitation is LIMITED to the persistent agent workspace volume (praktor-wk-<workspace>, mounted at /workspace/agent) - the demonstrated scope is NOT an unrestricted host-filesystem write. Impact is fully realized only when the Claude agent subsequently reads the planted/overwritten file (e.g. CLAUDE.md, skill, hook, or config), so the injection takes effect on a later agent run rather than instantly. The documented workaround that restricts realistic exposure is setting telegram.allow_from to trusted user IDs; the vendor states upgrading to v0.9.1 is the recommended (complete) fix.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no user interaction, and the advisory confirms the default configuration (allow_from: [] = allow all) removes any authentication precondition, so in a default deployment any Telegram user who can reach the bot qualifies - PR:N is justified here. The vuln.today decision label is 'this_week', indicating prioritized but not emergency handling. No EPSS probability and no CISA KEV status were supplied, and there is no CISA KEV listing in the input, so this is NOT confirmed actively exploited. The exploitation signal is a private, vendor-reported end-to-end proof of concept (credited to the reporter) - it is not public exploit code, so weaponization is not established. The headline score of 8.2 is driven by high integrity impact (stored instruction injection into the agent's CLAUDE.md/skill/hook/config surface), which is a genuinely serious capability because it persists across agent runs; however, real-world risk is materially constrained by product prevalence (a niche, single-maintainer orchestration project) and by the fact that the write primitive is scoped to the persistent agent workspace volume, not the host filesystem. Net: a real and credible priority for anyone actually running praktor at or below 0.9.0 with a default allowlist, but more a targeted/opportunistic concern than a mass-exploitation threat given the small deployment footprint.

An attacker messages a praktor bot running the default allow_from: [] (allow-all) configuration and uploads a Telegram document whose filename contains directory traversal (e.g. ../../../CLAUDE.md); path.Join collapses the ../ sequences so the file lands at the root of the persistent agent workspace instead of under uploads/. The attacker thereby overwrites CLAUDE.md or an agent instruction/skill/hook file that the Claude agent reads on later runs, turning a document upload into stored instruction injection against the agent's execution surface. The reporter provided a deployed end-to-end PoC privately to the vendor; no public exploit code is listed in the input.