traQ: XSS in the User Uploaded File Retrieval API
Historical advisory recorded 3 Nov 2026 19:57:16 UTC. Read the latest advisory.
cve-program · CVE-2026-63197
PublishedtraQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-63197
PublishedtraQ: XSS in the User Uploaded File Retrieval API
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
- Source published
- 3 Nov 2026 18:26:21 UTC
- Source modified
- 3 Nov 2026 18:26:21 UTC
- Saved here
- 3 Nov 2026 19:57:16 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N