While this path would not be leaked in Secret Chats, received media would still be stored in that same folder.
"In my case the path was (/var/folders/x7/khjtxvbn0lzgjyy9xzc18z100000gn/T/). While performing the same task under secret chat option the MediaResourceData(path://) URI was not leaked but the recorded audio/video message still gets stored on the above path," Mishra explained in
a report on the vulnerability. Dishra discovered that when the media self-destructed and was removed from the chat, the actual media files were still accessible in the computer's folder. "Bob (Attacker using tdesktop macOS) & Alice (Victim) they are communicating under secret chat option and Alice send a recorded audio/video message to Bob with a self-destructed timer of 20 seconds." "However the recorded message gets deleted from the chat after 20 seconds but still remains under Bob's custom path, over here Telegram fails to prevent the privacy for Alice. In general the functionality of self-destructing and leaving no traces failed," Mishra explains in an attack scenario shared with BleepingComputer.
This bug is particularly concerning for users who may be sending very sensitive video to other Telgrams users under the expectation that the app will automatically remove them after a set time. To illustrate this security issue, Mishra has provided the following video demonstration.
