Home Assistant’s Telegram download action stops accepting an arbitrary destination folder. A custom directory must be inside the configured allowlist, preventing the action from creating files elsewhere on the server, including through a symbolic link that leaves the allowed directory.
Franck Nijhof’s correction changes what existing automations may need: a custom destination must be added to allowlist_external_dirs. Downloads that omit the destination continue to use the telegram_bot folder inside Home Assistant’s configuration directory without an additional setting.