{"id":"CVE-2026-63197","title":"traQ: XSS in the User Uploaded File Retrieval API","summary":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct …","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"traPtitech","product":"traQ","affected":["traQ < 3.28.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T22:36:37.509432Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:40:46.296Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63197","references":[{"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7","label":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"},{"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","label":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e"},{"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3","label":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"}],"tags":["cve.org"],"epss":0.00286,"epssPercentile":0.2128,"ingestedAt":"2026-11-05T20:33:06.603Z","slug":"CVE-2026-63197","body":"## Overview\n\ntraQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.\n\n## Affected\n\n- `traQ < 3.28.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}