{"id":"CVE-2026-63197","aliases":["GHSA-p74g-f95m-7fx7"],"url":"https://o3.security/vulnerability/CVE-2026-63197","summary":"traQ: XSS in the User Uploaded File Retrieval API","details":"### Impact\n\nFor instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.\n\nAs a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.\n\n### Patches\n\nThis issue has been fixed in v3.28.3.\n\nAfter this fix, the file retrieval API always adds the `Content-Disposition` header to its responses regardless of the value of the `dl` query parameter. This prevents user-uploaded files from being displayed directly in the browser.\n\n### Workarounds\n\nTo mitigate the impact of this issue, apply either of the following workarounds:\n\n* Change `TRAQ_STORAGE_TYPE` to a storage backend other than `local`.\n* Ensure that all requests to `/files/{fileId}` include `dl=1`.\n\nUsers of this application can reduce the risk of exploitation by avoiding suspicious file URLs.","published":"2026-11-03T18:26:21.224Z","modified":"2026-11-05T03:30:32.421429770Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/traPtitech/traQ","fixedVersion":"1.0.0-rc.2.0.20260627142846-3db29e777166"}],"fix":{"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","label":"traPtitech/traQ@3db29e7"},"references":[{"type":"WEB","url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63197.json"},{"type":"ADVISORY","url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63197"},{"type":"FIX","url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e"},{"type":"PACKAGE","url":"https://github.com/traPtitech/traQ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:30:32.421429770Z"}}