A security researcher has disclosed a flaw in Telegram Desktop that let a crafted link read files off a victim's disk and send them straight to an attacker, with the victim's own session files among the possible targets. According to the write-up published by BeakSec, no confirmation prompt and no permission check stood between the link and the file.
The chain matters because it starts with something ordinary: someone adds you to a Telegram group and a link appears in the chat. Clicking it is enough. Telegram Desktop then passes that link to the instance already running on your machine, and it is inside that handover that the problem lives — a separator character it never escapes.
How the Telegram Desktop flaw worked
Operating systems let apps register their own URI schemes, so that a tg:// link launches Telegram. If the app is already open, the system still starts a second process, which connects to a local socket, hands the link to the running instance as plain text and exits. Structured data crossing a socket has to be flattened, and Telegram's format is simple: a keyword, its argument, and a semicolon closing each instruction.
The defect is that the semicolon is never escaped inside the transmitted link. A link carrying its own semicolon therefore arrives at the running instance split into two instructions instead of one. A harmless command sits on one side; on the other sits OPEN:, which accepts any URL with no filter on its scheme.
That leads to interpret:, an internal Telegram scheme registered nowhere in the operating system. It exists to let the app read a small instruction file naming a destination chat and a file to send. Reachable through the injected OPEN: command, it turned a clicked link into a way to read a file and ship it to a chat.
- The unescaped separator in Telegram Desktop's single-instance IPC splits one link into several commands.
