CVE-2021-41861

LOW 3.3CVE-2021-41861 · Published 04/10/2021 · updated 17/06/2026

In short

CVE-2021-41861 is a LOW (CVSS 3.3) vulnerability affecting telegram (telegram).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 26.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
telegram telegram	`≥ 7.5.0, ≤ 7.8.0`	No fix yet

Description

The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.

References

desktop.telegram.org/changelog · Release Notes
habr.com/ru/post/580582 · Third Party Advisory
pikabu.ru/story/konfidentsialnost_polzovateley_telegram_snova_narushena_predstaviteli_messendzhera_trebuyut_ne_raskryivat_podrobnostey_8511495 · Third Party Advisory
telegram.org/blog/autodelete-inv2/ru · Vendor Advisory

More vulnerabilities in telegram

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

≥ 7.5.0, ≤ 7.8.0

No fix yet

Description

More vulnerabilities in telegram

See all →