What happened
Both Telegram upload paths in praktor's bot.go build the destination file path by concatenating the attacker-controlled document filename with no traversal sanitization, letting a remote Telegram message write files to arbitrary host locations.
Why it matters
praktor puts a Telegram-facing, Docker-isolated multi-agent Claude Code fleet under operator control. An arbitrary file write from an unauthenticated message channel is a direct route into the orchestrator that supervises the coding agents and their credentials.
Attack vector
A Telegram sender uploads a document whose filename contains path-traversal segments; the bot concatenates it into the destination path without sanitization, allowing an arbitrary file write on the orchestrator host.
Affected systems
praktor before 0.9.1 — Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization.
Mitigation
Upgrade to praktor 0.9.1 or later (commit c3731ee); enforce filename sanitization on Telegram uploads.