- A BeakSec researcher showed that, on default settings with no local passcode, one click on a crafted link could let an attacker steal Telegram Desktop login files.
- The chain combined an unescaped separator with a forgotten internal release tool. The researcher says 7.2.9 fixed it, with no advisory. A local passcode makes a stolen session unusable.
- Check that Telegram Desktop on company machines is on 7.2.9 or later, and enforce a minimum version rather than relying on release notes.
A maintenance tool became a master key
Software often carries old tools that nobody removes. They are harmless while only trusted people can reach them. They turn dangerous the day someone opens a new door to them.
That is the lesson in a vulnerability chain published on October 12 by a researcher writing on BeakSec. The post shows how a clicked link could let an attacker read files from a Telegram Desktop user's computer and then take over the account. It describes a proof of concept. It does not report attacks in the wild.
The scope matters. The researcher's walkthrough relies on default settings: no local passcode, and automatic download of files received in groups. It also needs a victim who can be added to a group. The worked file-path example is for Windows. The post does not say how the walkthrough maps to other platforms.
What the researcher found
The chain has two defects. The first is in how Telegram Desktop passes links between its own processes. The second is an old internal command that sends any file it is pointed at to a chat, with no check and no prompt.
Telegram registers the tg:// link type with the operating system. If Telegram is already running, clicking such a link starts a second copy. That copy connects to the first through a local socket, a private channel inside the computer, and passes the link along as a line of text.
The format ends each instruction with a semicolon. According to the researcher, Telegram does not escape a semicolon that appears inside the link. A crafted link therefore arrives as several instructions instead of one.
One instruction type, OPEN:, accepts any URL with no filter on its scheme. That reaches a scheme called interpret:, which exists only inside Telegram's own code.
Per the post, Telegram's own team once used interpret: to post new releases. A script wrote a short text file naming a channel, a file and a caption, then launched Telegram with that file's path. The feature performs no authorization check. From the command line that was tolerable, because an attacker with that access could read the files anyway. Through the socket, it became a remote control.
How a link becomes a stolen account
The attacker first needs the instruction file on the victim's disk. The researcher says default settings supply the route. In group chats, Telegram Desktop saves incoming files of up to 8 MiB on its own, into a standard folder under the sender's file name. By default, the post adds, a user can be added to a group without confirming. The attacker adds the victim, posts the files and waits.
The attacker then sends an ordinary https link, behind which a server redirects to the crafted tg:// link. The detour is needed because tg:// links clicked inside Telegram are processed within the app and never touch the socket. Ordinary web links open in the system browser instead. Whether a prompt appears before Telegram launches depends on the browser and on whether the user has approved Telegram links before.
The targets are files in Telegram's local data folder. They are encrypted, but with no local passcode the key comes from an empty password and a salt. The researcher reports that the salt sits unprotected in the same file as the encrypted key. Reading that file unlocks the rest, including the session authorization. That session identifies the device to Telegram's servers, much like a website session cookie.
The researcher says three files are enough to rebuild the session on another machine. Each instruction file sends one target, and stacked commands in one link send all three.
A quiet fix
The researcher says Telegram fixed the chain in a commit dated September 16, 2026, and version 7.2.9 carries it. Telegram deleted the interpret: feature entirely. It also encodes semicolons found in link data, so they are no longer read as dividers between commands.
The commit adds two further guards. When a connection carries an OPEN: command, its CMD: and CTRL: records are ignored. Once a non-local URL appears, local file paths are discarded.
The release was low-key. The researcher says the 7.2.9 release notes list a rendering fix and nothing else. The commit is titled "Remove legacy interpret path helper", and no advisory accompanied it.
What leaders should ask
The shift here is that attack surface hides in features nobody remembers. Nothing in the release notes told a security team to hurry. A team that ranks updates by their notes alone would have had no signal here.
Put these questions to your IT and security leads.
First, do we know whether Telegram Desktop is installed on staff laptops outside our managed software catalogue, and are those copies on 7.2.9 or later? Second, can we enforce a minimum version instead of relying on release notes? Third, do staff keep company credentials, SSH keys or cloud tokens on the same machines? A file-read flaw exposes whatever sits on the disk, not only the chat account.
The researcher also lists steps that reduce exposure. Choose the setting that asks where to save each file, so nothing downloads automatically. Restrict group invitations to people in your contacts. Set a real local passcode. The passcode does not stop the files being stolen. Per the researcher, it makes a stolen session unusable.
Upgrading is the only step that closes the flaw. The rest buys time.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: beaksec.github.io.
