mtzanidakis CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH mtzanidakis CVE published 2026-11-03

CVE-2026-62331

A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume, escaping the documented uploads/ directory, by controlling the Telegram document filename which is concatenated into the destination path without sanitization. This allows planting or overwriting files the agent later consumes, turning a file upload into a stored injection into the agent's instruction/ [truncated]