{"id":"CVE-2026-63197","aliases":["EUVD-2026-116118","GHSA-p74g-f95m-7fx7"],"status":"published","title":"traQ: XSS in the User Uploaded File Retrieval API","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00286,"percentile":0.21349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-11-03T18:26:21.224Z","modified":"2026-11-09T21:00:04Z","fixes":[{"ecosystem":"Go","package":"github.com/traPtitech/traQ","fixed_in":["1.0.0-rc.2.0.20260627142846-3db29e777166"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/traPtitech/traQ","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-rc.2.0.20260627142846-3db29e777166"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traPtitech/traQ","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc.2.0.20260627142846-3db29e777166"}]}]}],"products":[{"vendor":"traptitech","product":"traq"}],"references":[{"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63197","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p74g-f95m-7fx7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63197.json","tags":["advisory"]},{"url":"https://github.com/traPtitech/traQ","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63197","title":"traQ: XSS in the User Uploaded File Retrieval API","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","status":"published","published":"2026-11-03T18:26:21.224Z","modified":"2026-11-03T22:40:46.296Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T23:33:09.822755Z"}],"euvd":[{"id":"EUVD-2026-116118","description":"traQ: XSS in the User Uploaded File Retrieval API","status":"published","published":"2026-11-09T20:52:49Z","modified":"2026-11-09T20:52:49Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-09T22:18:21.971974Z"}],"ghsa":[{"id":"GHSA-p74g-f95m-7fx7","title":"traQ: XSS in the User Uploaded File Retrieval API","description":"### Impact\n\nFor instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.\n\nAs a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.\n\n### Patches\n\nThis issue has been fixed in v3.28.3.\n\nAfter this fix, the file retrieval API always adds the `Content-Disposition` header to its responses regardless of the value of the `dl` query parameter. This prevents user-uploaded files from being displayed directly in the browser.\n\n### Workarounds\n\nTo mitigate the impact of this issue, apply either of the following workarounds:\n\n* Change `TRAQ_STORAGE_TYPE` to a storage backend other than `local`.\n* Ensure that all requests to `/files/{fileId}` include `dl=1`.\n\nUsers of this application can reduce the risk of exploitation by avoiding suspicious file URLs.","status":"published","published":"2026-11-09T20:52:49Z","modified":"2026-11-09T20:52:51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-09T21:19:53.571625Z"}],"nvd":[{"id":"CVE-2026-63197","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","status":"published","published":"2026-11-03T19:18:08.907Z","modified":"2026-11-03T23:17:50.943Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-04T01:48:44.629778Z"}],"osv":[{"id":"CVE-2026-63197","title":"traQ: XSS in the User Uploaded File Retrieval API","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","status":"published","published":"2026-11-03T18:26:21.224Z","modified":"2026-11-05T03:30:32.42142977Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"GHSA-p74g-f95m-7fx7","title":"traQ: XSS in the User Uploaded File Retrieval API","description":"### Impact\n\nFor instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.\n\nAs a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.\n\n### Patches\n\nThis issue has been fixed in v3.28.3.\n\nAfter this fix, the file retrieval API always adds the `Content-Disposition` header to its responses regardless of the value of the `dl` query parameter. This prevents user-uploaded files from being displayed directly in the browser.\n\n### Workarounds\n\nTo mitigate the impact of this issue, apply either of the following workarounds:\n\n* Change `TRAQ_STORAGE_TYPE` to a storage backend other than `local`.\n* Ensure that all requests to `/files/{fileId}` include `dl=1`.\n\nUsers of this application can reduce the risk of exploitation by avoiding suspicious file URLs.","status":"published","published":"2026-11-09T20:52:49Z","modified":"2026-11-09T21:00:04.05421181Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-09T21:10:16.277007Z"}]}}