CVE-2017-17715

high

Published 2017-12-16 · Modified 2026-05-13

CVSS v3

8.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2

6.8

VIR risk

8.8

Description

The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Application impact

Vendor	Product	Versions	Fixed
telegram	telegram_messenger	`{"endExcluding":"2017-12-08"}`	`2017-12-08`

References

https://bugs.chromium.org/p/project-zero/issues/detail?id=1470
https://bugs.chromium.org/p/project-zero/issues/detail?id=1470

CWEs

CWE-22

Verify integrity in audit chain (admin only). AS-IS.