{"id":"GHSA-p74g-f95m-7fx7","summary":"traQ: XSS in the User Uploaded File Retrieval API","details":"### Impact\n\nFor instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.\n\nAs a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.\n\n### Patches\n\nThis issue has been fixed in v3.28.3.\n\nAfter this fix, the file retrieval API always adds the `Content-Disposition` header to its responses regardless of the value of the `dl` query parameter. This prevents user-uploaded files from being displayed directly in the browser.\n\n### Workarounds\n\nTo mitigate the impact of this issue, apply either of the following workarounds:\n\n* Change `TRAQ_STORAGE_TYPE` to a storage backend other than `local`.\n* Ensure that all requests to `/files/{fileId}` include `dl=1`.\n\nUsers of this application can reduce the risk of exploitation by avoiding suspicious file URLs.","aliases":["CVE-2026-63197"],"modified":"2026-11-09T21:00:04.054211810Z","published":"2026-11-09T20:52:49Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-11-09T20:52:49Z","nvd_published_at":"2026-11-03T19:18:08Z","cwe_ids":["CWE-79"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63197"},{"type":"WEB","url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e"},{"type":"PACKAGE","url":"https://github.com/traPtitech/traQ"},{"type":"WEB","url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"}],"affected":[{"package":{"name":"github.com/traPtitech/traQ","ecosystem":"Go","purl":"pkg:golang/github.com/traPtitech/traQ"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc.2.0.20260627142846-3db29e777166"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}