When the Telegram Desktop client is already running, clicking a tg:// link spawns a new process that sends the URL to the existing instance over a local socket. The software builds the message by concatenating “OPEN:”, the URL, and a semicolon, but it does not escape semicolons that appear inside the URL. This lets an attacker inject additional commands after a semicolon, which the receiving instance treats as separate instructions.
The attacker first uploads a plain‑text instruction file to a Telegram group; Telegram Desktop automatically saves such attachments to a predictable location (e.g., %USERPROFILE%/Downloads/Telegram Desktop). By crafting a link like tg://x?a=1;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions.txt the injected OPEN:interpret: command tells Telegram to read the file and send its contents to a chat. Stacking several such commands in one link allows multiple arbitrary files to be exfiltrated with a single click.
This image depicts the attack chain described in the article, where a malicious tg:// link leads to unauthorized access to Telegram's local data files.
The stolen files can include Telegram’s local data, specifically the key_datas file (holding the salt and encrypted Data Encryption Key) and the MTProto authorization file. If the user has not set a local passcode, the Key Encryption Key is derived from the empty password and the salt alone, allowing the attacker to unwrap the DEK and decrypt the authorization file, thereby obtaining full control of the victim’s Telegram account. The issue is tracked as CVE-2026-107181, rated CVSS 8.1 High, and was patched in version 7.2.9 (commit db3405699f).