Live › vulnerability › CVE-2026-63197
traQ, a messenger for the Digital Creators Club traP, serves user-uploaded SVG or HTML files directly from its /files/{fileId} endpoint when local storage is configured. An attacker who can upload a file can get JavaScript to run in another user's browser when that user opens the file URL.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Instances of traQ before 3.28.3 that use local file storage (TRAQ_STORAGE_TYPE=local) are exposed, since the /files/{fileId} endpoint serves uploaded SVG and HTML for direct rendering. Instances using other storage types, or already on 3.28.3 or later, are not affected by this description.
No product ranges from the sources yet.
3.28.3 are affected.TRAQ_STORAGE_TYPE is set to local in the deployment configuration.3.28.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-63197")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.