Telegram Desktop High-Risk Vulnerability Can Steal Arbitrary Local Files, Fixed in Version 7.2.9

Odaily reports that security researcher beaksec (Emiliano Versini) has disclosed a high-risk vulnerability, CVE-2026-107181, affecting Telegram Desktop 7.2.8 and earlier versions. Attackers can craft a malicious tg:// link to read arbitrary local files via IPC injection, including tdata session files, and send them to an attacker-controlled channel, potentially leading to account takeover. The vulnerability has been fixed in version 7.2.9.