CVE-2026-63197

The messenger application traQ is vulnerable to Cross-Site Scripting (XSS) in its User Uploaded File Retrieval API. In versions prior to 3.28.3 , instances configured with TRAQ_STORAGE_TYPE=local allow the /files/{fileId} endpoint to return user-uploaded SVG or HTML content for direct browser ren...

CVE-2026-63197 traQ: XSS in the User Uploaded File Retrieval API

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQSTORAGETYPE=local can return user-uploaded SVG or HTML content from the /files/fileId retrieval endpoint for direct browser rendering. An attacker with file-upload capability can...