From 82f9aa1a2a0970e48caf8d7f4a60284347a13d99 Mon Sep 17 00:00:00 2001
From: 23rd <23rd@vivaldi.net>
Date: Tue, 31 Mar 2026 13:35:57 +0300
Subject: [PATCH] Fixed path traversal in bulk file download via filename
 sanitization.

---
 Telegram/SourceFiles/menu/menu_item_download_files.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Telegram/SourceFiles/menu/menu_item_download_files.cpp b/Telegram/SourceFiles/menu/menu_item_download_files.cpp
index be5e060d87..a105e58f1e 100644
--- a/Telegram/SourceFiles/menu/menu_item_download_files.cpp
+++ b/Telegram/SourceFiles/menu/menu_item_download_files.cpp
@@ -7,6 +7,7 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 */
 #include "menu/menu_item_download_files.h"
 
+#include "base/base_file_utilities.h"
 #include "core/application.h"
 #include "core/core_settings.h"
 #include "core/file_utilities.h"
@@ -161,7 +162,9 @@ void AddAction(
 	const auto saveDocuments = [=](const QString &folderPath) {
 		for (const auto &[document, origin] : documents) {
 			if (!folderPath.isEmpty()) {
-				document->save(origin, folderPath + document->filename());
+				const auto name =
+					base::FileNameFromUserString(document->filename());
+				document->save(origin, folderPath + name);
 			} else {
 				DocumentSaveClickHandler::SaveAndTrack(origin, document);
 			}