CVE-2026-63197

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

• CWE-79

• https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e
• https://github.com/traPtitech/traQ/releases/tag/v3.28.3
• https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63183OmniAuth is a flexible authentication system utilizing Rack …6.9
• CVE-2026-63184Refitter is a tool for generating a C# REST API client using…7.1
• CVE-2026-63187Logto is the modern, open-source auth infrastructure for Saa…6.3
• CVE-2026-63188Logto is the modern, open-source auth infrastructure for Saa…8.7
• CVE-2026-6319Use after free in Payments in Google Chrome on Android prior…7.5
• CVE-2026-63190FearlessCMS is a flat-file `content` management system cente…9.4
• CVE-2026-63198traQ is a messenger application built for Digital Creators C…7.3
• CVE-2026-63199Perses is an open-source dashboard and visualization project…8.3
• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-63201Netopeer2 is a server for implementing network configuration…7.1
• CVE-2026-63203Logto is the modern, open-source auth infrastructure for Saa…7.6
• CVE-2026-63204Zammad is a web based open source helpdesk/customer support …2.3