Telegram Desktop versions below 7.2.9 contain a critical vulnerability (CVE-2026-107181). After users click a malicious tg:// link, system files can be silently stolen without confirmation.
The vulnerability stems from an unescaped semicolon in the link being treated as an independent IPC command. Combined with the interpret: handler, it can steal arbitrary files, including documents, browser sessions, SSH keys, and cryptocurrency wallets. The issue has been fixed in version 7.2.9. Users are advised to upgrade as soon as possible, beware of suspicious tg:// links, and enable a local password.
Affected versions: Telegram for Windows versions below 7.2.9 are affected. Prerequisite for the attack: being in the same group. Since the file is only a few bytes in size, Telegram usually downloads it automatically. Versions below 7.2.8 are affected; the tested version was 6.7.8. Clicking the link enables data exfiltration.