Telegram Messenger For Android Directory Traversal
There is a directory traversal issue in the Telegram client for Android. The method saveFile in MediaController.java saves a file to external memory based on an optional name that is not filtered. The name is provided by the remote peer when sending a document or music file.
Source: Telegram Messenger For Android Directory Traversal