CVE-2026-63197

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

traQ: XSS in the User Uploaded File Retrieval API

Impact

For instances where TRAQ_STORAGE_TYPE is set to local, the file retrieval API /files/{fileId} could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.

As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.

Patches

This issue has been fixed in v3.28.3.

After this fix, the file retrieval API always adds the Content-Disposition header to its responses regardless of the value of the dl query parameter. This prevents user-uploaded files from being displayed directly in the browser.

Workarounds

To mitigate the impact of this issue, apply either of the following workarounds:

• Change TRAQ_STORAGE_TYPE to a storage backend other than local.
• Ensure that all requests to /files/{fileId} include dl=1.

Users of this application can reduce the risk of exploitation by avoiding suspicious file URLs.

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

Impact

For instances where TRAQ_STORAGE_TYPE is set to local, the file retrieval API /files/{fileId} could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.

As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.

Patches

This issue has been fixed in v3.28.3.

After this fix, the file retrieval API always adds the Content-Disposition header to its responses regardless of the value of the dl query parameter. This prevents user-uploaded files from being displayed directly in the browser.

Workarounds

To mitigate the impact of this issue, apply either of the following workarounds:

• Change TRAQ_STORAGE_TYPE to a storage backend other than local.
• Ensure that all requests to /files/{fileId} include dl=1.

Users of this application can reduce the risk of exploitation by avoiding suspicious file URLs.