Telegram Desktop Flaw Could Allow Account Takeover Under Conditions

A high-severity vulnerability in Telegram Desktop version 7.2.8 and earlier could allow account takeover under certain conditions, including the theft of a session file from a user without a local password.

The flaw, tracked as CVE-2026-107181, involved placing a command file in a group and persuading a victim to open a link redirected through a browser. The process could enable command injection between applications and allow local files to be sent to a group controlled by an attacker.

An attacker would need to obtain the victim’s session file for an account takeover to occur. Accounts without a local password were exposed to that risk under the described conditions.

Telegram fixed the vulnerability in Desktop version 7.2.9, released Sept. 17. Versions 7.2.8 and earlier were affected.