---
id: CVE-2026-63197
title: 'traQ: XSS in the User Uploaded File Retrieval API'
summary: >-
  traQ is a messenger application built for Digital Creators Club traP. Prior to
  3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return
  user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint
  for direct …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: traPtitech
product: traQ
affected:
  - traQ < 3.28.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T22:36:37.509432Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:40:46.296Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63197'
references:
  - url: 'https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7'
    label: 'https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7'
  - url: >-
      https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e
    label: >-
      https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e
  - url: 'https://github.com/traPtitech/traQ/releases/tag/v3.28.3'
    label: 'https://github.com/traPtitech/traQ/releases/tag/v3.28.3'
tags:
  - cve.org
epss: 0.00286
epssPercentile: 0.2128
ingestedAt: '2026-11-05T20:33:06.603Z'
---

## Overview

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

## Affected

- `traQ < 3.28.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.