The vulnerability arises from concatenating an attacker‑controlled document filename into a destination path without sanitization in telegram upload sites. When the filename contains parent‑directory traversal characters, the Go function "path.Join" collapses them, allowing the attacker to write files outside the intended uploads directory. This results in stored instruction injection, as the attacker can overwrite or create configuration files that a Claude agent later reads and executes.

Versions of praktor prior to 0.9.1, such as 0.9.0 and older, are affected. The product is the multi‑agent Claude orchestrator that provides Telegram‑based input and output, Docker isolation, and a Mission Control UI, with the launch directory at /workspace/agent. All installations that do not have the recent release are vulnerable unless patched.

The CVSS score of 8.2 indicates a high severity, and the EPSS score is not available while the vulnerability is not listed in CISA's KEV catalog. The vulnerability can be exploited remotely by any Telegram user who can message the bot, as the default configuration allows all senders. No prior authentication or privilege escalation is required, so the attacker can write arbitrary files into the persistent agent workspace, potentially tampering with CLAUDE.md, instruction, skill, hook, or configuration files that the agent later reads. This persistence can lead to a compromise of future agent runs and is therefore a significant threat.