{"affected":[{"product":"traQ","source":"CNA: GitHub_M","vendor":"traPtitech","versions":[{"status":"affected","version":"< 3.28.3"}]},{"ecosystem":"ghcr","packageName":"ghcr.io/traptitech/traq","product":"ghcr.io/traptitech/traq","source":"GitHub GHSA-p74g-f95m-7fx7","vendor":"","versions":[{"status":"affected","version":"<3.28.3","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-63197","cwes":["CWE-79"],"description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.3,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},{"score":7.3,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793747870943,"publishedAt":1793730381224,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-p74g-f95m-7fx7","text":"ghcr.io/traptitech/traq (ghcr): GitHub reports patched versions 3.28.3. Check the advisory for the affected release branch.","url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"}],"revision":"ffa78f78403324f0381bedf8eb5009a2b1f99bf3f2a69f7959df04ad82fdaa97","sources":[{"modifiedAt":1793745646296,"name":"CNA: GitHub_M","retrievedAt":1793748334655,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63197"},{"modifiedAt":1793747870943,"name":"NVD","retrievedAt":1793751698845,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63197"},{"modifiedAt":1784211084000,"name":"GitHub Security Advisories","retrievedAt":1793817609782,"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"}],"ssvc":{"assessedAt":1793745397509,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"traQ: XSS in the User Uploaded File Retrieval API","updatedAt":1793817609782}