PatchTheCVECVE-2020-25824: Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export T
CVE-2020-25824 is a low-severity flaw (CVSS 2.4) affecting telegram desktop. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.4 (Low) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 54%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2020-10-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-25824?
telegram desktop: upgrade to newer than 2.4.3. Exact commands for each OS are on this page.
Is CVE-2020-25824 being exploited?
CVE-2020-25824 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-25824 affect?
CVE-2020-25824 affects telegram desktop. Severity is low (CVSS 2.4). Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker the
How urgent is CVE-2020-25824?
Priority 20/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2021-47793 HIGH 7.5 DOWNGRADE Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the applicati
- CVE-2021-36769 MEDIUM 5.3 UPGRADE UPGRADE A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram De
- CVE-2020-17448 HIGH 7.8 UPGRADE Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protect
- CVE-2020-12474 MEDIUM 6.5 UPGRADE UPGRADE Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow a
- CVE-2019-10044 HIGH 8.8 MITIGATE UPGRADE Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulne