There is a directory traversal issue in the Telegram client for Android. The method saveFile in MediaController.java saves a file to external memory based on an optional name that is not filtered. The name is provided by the remote peer when sending a document or music file.
7ffd15f66d899cf5ad6ff6674833eb1870b4935ff336fb675f5220f416be335f