CVE-2019-16248

The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message).

• https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdfThird Party Advisory
• https://www.inputzero.io/2019/09/telegram-privacy-fails-again.htmlExploit, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/09/09/2Mailing List, Third Party Advisory
• https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdfThird Party Advisory
• https://www.inputzero.io/2019/09/telegram-privacy-fails-again.htmlExploit, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/09/09/2Mailing List, Third Party Advisory

Published

Sep 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16242On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an …6.8
• CVE-2019-16243On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an …6.1
• CVE-2019-16244OMERO.server before 5.6.1 allows attackers to bypass the sec…9.8
• CVE-2019-16245OMERO before 5.6.1 makes the details of each user available …5.3
• CVE-2019-16246Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), …9.8
• CVE-2019-16247Delta DCISoft 1.21 has a User Mode Write AV starting at Comm…7.8
• CVE-2019-16249OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_lo…5.3
• CVE-2019-1625A vulnerability in the CLI of Cisco SD-WAN Solution could al…7.8
• CVE-2019-16250includes/wizard/wizard.php in the Ocean Extra plugin through…7.5
• CVE-2019-16251plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Fram…4.3
• CVE-2019-16252Missing SSL Certificate Validation in the Nutfind.com applic…5.9
• CVE-2019-16253The Text-to-speech Engine (aka SamsungTTS) application befor…7.8