{"id":"CVE-2026-63197","kind":"vulnerability","aliases":["CVE-2026-63197"],"related":[],"title":"traQ: uploaded SVG or HTML files run script in victims' browsers","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","summary":"traQ, a messenger for the Digital Creators Club traP, serves user-uploaded SVG or HTML files directly from its /files/{fileId} endpoint when local storage is configured. An attacker who can upload a file can get JavaScript to run in another user's browser when that user opens the file URL.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-upload","other","self-hosted","traq"],"not_affected_if":["managed-hosting","non-local-storage"],"how_to_check":"- Check the traQ version in use; versions before `3.28.3` are affected.\n- Check whether `TRAQ_STORAGE_TYPE` is set to `local` in the deployment configuration.","fix":"- Upgrade traQ to `3.28.3` or later.","status":"open","published_at":"2026-11-03T19:18:08+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","triaged_at":"2026-11-03T19:45:34+00:00","updated_at":"2026-11-03T19:45:34+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T19:45:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade traQ to `3.28.3` or later.","reach":"internet","title":"traQ: uploaded SVG or HTML files run script in victims' browsers","impact":"medium","summary":"traQ, a messenger for the Digital Creators Club traP, serves user-uploaded SVG or HTML files directly from its /files/{fileId} endpoint when local storage is configured. An attacker who can upload a file can get JavaScript to run in another user's browser when that user opens the file URL.","audience":"businesses","category":"other","nicknames":[],"who_cares":["traq","self-hosted","file-upload"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker JavaScript runs in victim's browser session","analyst_note":"","how_to_check":"- Check the traQ version in use; versions before `3.28.3` are affected.\n- Check whether `TRAQ_STORAGE_TYPE` is set to `local` in the deployment configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","non-local-storage"],"who_is_affected":"Instances of traQ before 3.28.3 that use local file storage (TRAQ_STORAGE_TYPE=local) are exposed, since the /files/{fileId} endpoint serves uploaded SVG and HTML for direct rendering. Instances using other storage types, or already on 3.28.3 or later, are not affected by this description.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4221,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63197':14A,17A '/files':46B,110C '3.28.3':91C,157C 'activ':128C 'anoth':67B,132C 'applic':82C 'attack':55B,119C,141C 'attacker-control':140C 'browser':11A,70B,116C,150C 'built':83C 'capabl':124C 'caus':139C 'club':33B,87C 'configur':53B,93C 'content':107C,129C 'control':142C 'craft':127C 'creator':32B,86C 'cve':12A,15A 'digit':31B,85C 'direct':43B,115C 'endpoint':48B,113C 'execut':145C 'file':6A,19B,42B,60B,76B,122C,137C 'file-upload':18B,121C 'fileid':47B,111C 'fix':154C 'get':62B 'host':24B 'html':5A,41B,106C 'induc':131C 'instanc':92C 'issu':152C 'javascript':63B,143C 'local':50B,98C 'messeng':28B,81C 'open':74B,135C 'prior':89C 'provid':126C 'render':117C 'retriev':112C 'return':100C 'run':7A,65B 'script':8A 'self':23B 'self-host':22B 'serv':35B 'storag':51B,96C 'svg':3A,39B,104C 'trap':34B,88C 'traq':1A,25B,26B,78C,95C 'type':97C 'upload':2A,20B,38B,58B,103C,123C 'url':77B,138C 'user':37B,68B,73B,102C,133C 'user-upload':36B,101C 'version':156C 'victim':10A,148C","nicknames":[],"mitigations":[],"who_affected":"Instances of traQ before 3.28.3 that use local file storage (TRAQ_STORAGE_TYPE=local) are exposed, since the /files/{fileId} endpoint serves uploaded SVG and HTML for direct rendering. Instances using other storage types, or already on 3.28.3 or later, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fileupload","high","other","selfhosted","traq"],"campaign_type":null,"first_public_at":"2026-07-01T11:20:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63197","severity":null,"published_at":"2026-11-03T19:18:08+00:00","modified_at":"2026-11-03T19:18:08+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","fetched_at":"2026-11-03T19:44:53+00:00","note":null}],"documents":[{"id":60204,"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60205,"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60206,"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:20:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}