high2026-11-03 CVE-2026-62331-praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) GHSA-48v2-6jcm-fc99