What’s Vulnerable › Vulnerabilities

CVE-2017-17715

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-16 · updated 2026-06-17
• Weakness: CWE-22

Description

The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.

Affected products

• Telegram Messenger: before 2017-12-08 — fixed in 2017-12-08

How to fix

Upgrade to a fixed version: Telegram Messenger 2017-12-08. Check the vendor advisory for mitigations.

References

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1470
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1470

Get alerted when CVE-2017-17715 or the next vulnerability affects your stack