Telegram Desktop Vulnerability Exposes User Files via Malicious Link

Why Session Files Were the Primary Target

A security flaw in Telegram Desktop allowed attackers to steal any user's files simply by tricking them into clicking a malicious link, with session data among the most sensitive information at risk. The vulnerability, discovered and reported by independent researcher beaksec, existed in the application's single-instance inter-process communication mechanism and remained unpatched for several days in October 2026. The issue stemmed from an unescaped separator in the IPC protocol, which could be exploited through a specially crafted URL to read and exfiltrate arbitrary files from the victim's local filesystem.

How the Exploit Worked Through a Single Click The attack leveraged Telegram Desktop's handling of custom URI schemes when the application was already running. When a user clicked a malicious link—such as one sent via chat or email—the flawed IPC parser failed to properly sanitize input, allowing an attacker to inject a path traversal sequence. This enabled the unauthorized reading of files outside intended directories, including session files stored in the application's data folder. Once obtained, these session files could be used to hijack the victim's Telegram account without requiring two-factor authentication, effectively granting full access to messages, contacts, and media. The researcher demonstrated that the exploit required no user interaction beyond the initial click and worked across Windows, macOS, and Linux versions of the desktop client.

Could This Affect Mobile Users Too?

Session files in Telegram Desktop contain encrypted authentication tokens that maintain a user's logged-in state. If an attacker gains access to these files, they can impersonate the user on any device by importing the session data into a separate instance of Telegram Desktop. This bypasses the need for passwords or authentication codes, making it a highly effective method for account takeover. The vulnerability was particularly dangerous because the stolen files could be transmitted to the attacker's server silently, leaving no immediate trace in the user's chat history or notifications. Beaksec emphasized that the exploit did not require any elevated privileges on the victim's system, only the ability to trigger the malicious link through the desktop client's URL handler.

While the vulnerability was specific to the desktop version of Telegram, mobile users were not directly at risk from this particular exploit due to differences in how iOS and Android handle URI schemes and inter-process communication. However, the researcher noted that any compromise of a desktop session could still lead to indirect risks for mobile users, such as attackers sending malicious links or files from the hijacked account. Telegram's security team acknowledged the report and released a patched version of Telegram Desktop on October 7, 2026, which implemented proper input validation and escaping in the IPC parser. Users were advised to update immediately to versions released after October 7 to mitigate the risk.

How could an attacker deliver the malicious link to a victim? The link could be sent through any channel that supports clickable URLs, including Telegram chats, email, or social media, and required only that the victim click it while Telegram Desktop was running.

Frequently Asked Questions

Was two-factor authentication effective against this attack? No, because the exploit stole session files that bypassed authentication entirely, allowing account access without needing passwords or 2FA codes.

Did the vulnerability affect the web or mobile versions of Telegram? No, the flaw was confined to the desktop client's IPC mechanism and did not impact Telegram Web, iOS, or Android applications.