CVE-2026-107181 was published on 7 October 2026 for a flaw in Telegram Desktop before 7.2.9 that researcher beaksec described in a technical write-up first published on 3 October and updated on 7 October. When a link is opened from outside Telegram (for example from a browser), a second instance passes it to the running app over a local inter-process channel that did not escape its record separator (CWE-143). A crafted tg:// link with an unescaped semicolon could therefore inject an extra command that reached an old internal helper, once used for release publishing, which uploads a local file to a chat without any permission check or prompt.

Files that can be taken include Telegram's tdata session keys, so an attacker can take over the account when no local passcode is set.

The demonstrated chain was on Windows with version 6.9.3 and is said to work through 7.2.8; it also relies on group files downloading automatically and on anyone being able to add the victim to a group, and the browser may ask before launching the app. Links clicked inside Telegram are not affected. Telegram fixed it in commit db3405699f (16 September) and released 7.2.9 on 17 September 2026 without a separate advisory; CVSS 3.1 is 8.1.

No exploitation in the wild is known. Primary: CVE record (NVD) and Telegram's fix; wire: ThreatWire.