Telegram Desktop vulnerability allowed any user's file to be stolen

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.